I have one props placed in location , opt splunk etc apps appname local props Below is the code
[db_accounts]
DATETIME_CONFIG =
EXTRACT-AUTHID = \s+(?[A-Za-z]\w+)(,|\n)
EVAL-sourcetype = if(source like "%rgn%","db_log_summaries",sourcetype)
EXTRACT-PRIM_ID,CORR_ID,DATE,TIME,TABLE,DBASE,TBLSPACE,UPS,DES,NS = (?\w+)\s+(?(\W\w+|\w+))\s+(?\d{4}-\d{2}-\d{2})\s+(?
↧