Our application logs events to the Windows application events with custom SourceNames. Need help to extract the fields using the props and transforms. I am able to extract the fields search time using the rex command, but the same doesn't work in props.conf .
tried extracting one field -
REGEX working in search - rex field=Message "^[^\]\n]*\]\s+(?P\w+)"