Hello,
In my linux data, two versions of the same hostname have turned up.
and .local.
Now I have been able to change the host field using both
eval host=replace(host, ".local", "")
and
rex mode=sed field=host "s/.local//g"
at searchtime, but I'm having issues setting up a field transformation.
What do I fill in? These are my guesses...
Destination app: search
Name: remove .local
Type: regex-based
Regular expression: ".local(?\S+)" <-- something like this?
Format: Big questionmark
Source Key: host?
