Hi, I am trying to get rid of 2 events from a XML file I am trying to ingest,
I am editing the transforms.conf to send 2 events to the null queue,
the 2 events I am trying to get off are the and (an example of the XML file is below)
-80.33100097073213,25.10742916222947
Interdiction
23
Ironwood
2013-04-24
00:07:00
0
-80.23429525620114,24.08680387475695
Rustic
so my transform is able to get rid of the tag but I cannot get rid of the tag
my props.conf for this sourcetype looks like
[dreamcrusher]
DATETIME_CONFIG =
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = true
category = Custom
pulldown_type = 1
BREAK_ONLY_BEFORE =
LINE_BREAKER =
TRUNCATE = 5000
disabled = false
TRANSFORMS-datarootnull = DATAROOTNULL
MUST_BREAK_AFTER =
and my transforms.conf for this transform looks like
[2DATAROOTNULL]
REGEX = <.*?dataroot>
DEST_KEY = queue
FORMAT = nullQueue
any help would be greatly appreciated!
Thanks
↧