Hi,
I have an SQL input being consumed via DBConnect 2.4 which has several fields including 'Message' and 'Originating System'. They are currently being sent to our indexers under the sourcetype 'auditlog' and the fields are being extracted correctly (as the are defined fields in the SQL table).
I am now trying to have every event with an 'Originating System' attribute of 'SendToABC' be given a new sourcetype. I have been able to do this but my issue is that now the 'Originating System' field is no longer automatically extracted for the new sourcetype.
I could of course set the new sourcetype to extract the field but this is more a case of wanting to know WHY this is happening.
I am using:
props.conf
`[AuditLog]
TRANSFORMS-sourcetype_change= sendtoabc_sourcetype
`
transforms.conf
`[sendtoabc_sourcetype]
REGEX = (?SendToABC)
FORMAT = sourcetype::sendToABC
DEST_KEY = MetaData:Sourcetype
LOOKAHEAD = 20000
`
Any help would be appreciated. Thank you.
↧