The data is "partly" indexed and extracted.
The fields include custom Timestamps, task durations etc.,
For Example each line in the file would be like :
F1 F2 F3,F4:F5
(F1, F2.. are fields)
My Question is if we initially decide to extract only F1, F2
using transforms.conf and props.conf but later decide to extract remaining fields (F3,F4,F5) also
for old data/events(by changing transforms.conf).
How do I apply this new rule in transforms.conf to the old data/events to extract/index remaining fields (F3,F4,F5)?
... View more