Hello,
I have a file that doesnt seems to be breakable via the standard line breaker since it's a full text file with no \n or \r whatsoever. Using delimiters for lines didnt work so I want to use sedcmd on the keywords and add a \n as a suffix in order to define the lines. After that i wish to send the data back into the parsing queue and tag the whole thing with a new sourcetype to apply setting that use \n as a linebreaker.
Bellow is what i have so far. sedcmd is working and redirection to the new sourcetype is too but the settings of that sourcetype (test1 bellow) isn't being applied so no line break is happening.
**PROPS**
[test]
BREAK_ONLY_BEFORE = blabla
CHARSET =
DATETIME_CONFIG =
NO_BINARY_CHECK = true
SEDCMD-replace = s/\sblabla/\nblabla/g
SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true
category = Custom
pulldown_type = true
TRANSFORMS-t1= redirect,reparse
[test1]
SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true
**TRANSFORMS**
[reparse]
REGEX=(.)
FORMAT=aggQueue
DEST_KEY=queue
[redirect]
REGEX=(.)
FORMAT = sourcetype::test1
DEST_KEY = MetaData:Sourcetype
example data:
blabla asd asd asd asd as asda sdasd asd asd blabla asd asd asdaddddddddddddddddddddddddddddddddddddddddddd ddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd dddddddddddddddddddddddddddddddddddddd aaaaaaaweeeeeeeeeeeeeeeeeeeeeeee bla blabla assssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssss
thanks for the help,
David
↧