...onfiguration syntax to set up fields.conf with the same regex and number of fields.
^(? [^ ]+)\s[^ ]+\,[0-9]+ \[(? [^ ]+)\] New documents[ ]+: (? [^a-zA-Z._]*) \<[0-9 ]+ \((? [^ ]+)\)\> *DATASOURCE.(? ....
...ac_addr
Setting fields.conf as follows:
[mac_addr]
INDEXED = false
INDEXED_VALUE = false
While using a TOKENIZER of ([^,]\*) doesn't change the behavior of a basic search, like "*" ....
...riting it inline none of it is working. Used fields.conf:
[allowed_ip]
TOKENIZER=([^\,]+)
Also tried to implement it in props.conf and transforms.conf:
props.conf
[abc:pce:metadata]
E...
I'm trying to get a new sourcetype (NetApp user-level audit logs, exported as XML) to work, and I think my fields.conf tokenizer is breaking things. But I'm not really sure how, or why, or what to d...
I'm running a search based on a field extracted at search time using props.conf.
I've noticed that if I don't have a fields.conf, my search works fine. Instead if I create a fields.conf and I s...
I was wondering if it's possible to extract an mv field, from an already extracted field, using fields.conf?
For example:
I have a series of data
ANSWER SECTION:
Offset = 0x0016, RR c...
Hi, There is the description for INDEXED_VALUE in fields.conf INDEXED_VALUE = [true|false|<sed-cmd>|<simple-substitution-string>]
* Set this to true if the value is in the raw t...
...o ./etc/system/local/fields.conf :
[field_a]
TOKENIZER = ([^\|]+)
[field_b]
TOKENIZER = ([^\|]+)
The only problem is that above approach seems to have global effect across all indexes and a...
I'm adding fields in my json format data like, below. The issue is, the search "index=myHEC *" returns data but "index=myHEC myType=Find_me " is not working.
{
"time": 1507522387,
"host": "m...
...vents, but its not parsing the field that I wanted,
so I used rex to get the field parsed and this worked, bu then I couldn't do any searches on the field, because I need to adjust fields.conf or s...