Getting Data In

relationship between props.conf and transforms.conf

shangshin
Contributor

I added a sourcetype, weblogic_access_log, with its customized field (wl_kv_and_fields
) in props.conf and transforms.conf. If I need to add another sourcetype e.g. tomcat_access_log with a different customized field e.g. tomcat_kv_and_fields. How could I define it in transforms.conf? Hope I am understood. Thanks!

in props.conf

[weblogic_access_log]

REPORT-myfields = wl_kv_and_fields

in transforms.conf

DELIMS = "\t"

FIELDS = date, time, ip, remote-user, user-agent, method, uri-stem, uri-query, status, bytes, time-taken
Tags (2)
0 Karma
1 Solution

MatthewTowey
Path Finder

Hi shangshin

In your props.conf file you have "REPORT-myfields = wl_ kv_ and_ fields" so the stanza been referenced in transforms.conf has to be called "wl _kv _and _fields". For example

[wl_ kv_ and_fields]

DELIMS = "t"

FIELDS = date, time, ip, remote-user, user-agent, method, uri-stem, uri-query, status, bytes, time-taken

You can reference this stanza for any amount of sources/sourcetypes provided you use the line "REPORT-myfields = wl_ kv_ and_fields"

View solution in original post

0 Karma

MatthewTowey
Path Finder

Hi shangshin

In your props.conf file you have "REPORT-myfields = wl_ kv_ and_ fields" so the stanza been referenced in transforms.conf has to be called "wl _kv _and _fields". For example

[wl_ kv_ and_fields]

DELIMS = "t"

FIELDS = date, time, ip, remote-user, user-agent, method, uri-stem, uri-query, status, bytes, time-taken

You can reference this stanza for any amount of sources/sourcetypes provided you use the line "REPORT-myfields = wl_ kv_ and_fields"

View solution in original post

0 Karma

shangshin
Contributor

good answer. Thanks!

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!