I wanted to add a field to a specific sourcetype
basically
nocmessage="ignore this server"
Seemed easy enough
props.conf
EVAL-nocmessage="ignore this server"
But doesn't seem to work. If I toss that same message into a if statement it how ever does work. Is there a trick to this?
↧