On my Intermediates or Heavy Forwarders and Search Heads I have:
props.conf
[role_extract]
TRANSFORMS-roleextract = extract_role
transforms.conf
[extract_role]
REGEX=\D{3}\D\d{1,4}(...)\d{1,5}
FORMAT = role::$1
SOURCE_KEY = host
WRITE_META = true
fields.conf
[role]
INDEXED = true
I dont get the extracted values thought when I search for this field.
Im probably doing something incorrectly.
Thanks for the help
Hi there, can you provide sample data to see if regex match is working.