extract field from MetaData:Source

[schose]

Hi all,

I'm trying to extract the field "vservice" from Source as the last two characters (after _) from sourcetype "catalina".

props.conf

[catalina]
REPORT-vservice=vservice

transforms.conf

[vservice]
REGEX=_(\w\w)$
FORMAT=vservice::$1
SOURCE_KEY=MetaData:Source

I don't see why it's not working... 😞

index="myindex" | rex field=source _(?<vservice>\w\w)$ 

which should be the same is working fine for me.

Regards,

Andreas

[schose · Accepted solution]

hi,

placing

SOURCE_KEY=MetaData:Source with
SOURCE_KEY=source

in transforms.conf seems to work.

Regards,

Andreas