We are collecting various data from security equipment. The data is being stored in index=sec_A and received as sourtype=A_syslog. Here, in the props.conf setting, several data are filtered as follows, and the data is stored by dividing it into different source types and indexes. [A_syslog] TRANSFORMS-<class_A> = a, b, c, d TRANSFORMS-<class_B> = e, f, g Here, I want to add additional data to be filtered by b, but these data are different from the data currently being collected and timestamp REGEX, so I think I need to collect them in a different way. Is there a way to specify a different timestamp value only for the data being added while the data collection is continuing?
... View more