On my Intermediates or Heavy Forwarders and Search Heads I have:
TRANSFORMS-roleextract = extractrole
FORMAT = role::$1
SOURCEKEY = host
WRITE_META = true
INDEXED = true
I dont get the extracted values thought when I search for this field.
Im probably doing something incorrectly.
Thanks for the help
Hi there, can you provide sample data to see if regex match is working.