4
responses

Hi, how can I truncate message to custom fields? For example:

I have:

message: 2016-09-26 12:58:54 ru1-t001-web01 INFO "\Processor(_Total)\% Processor Time"="50.762249"

I need:

message: 2016-09-26 12:58:54 ru1-t001-web01 INFO "\Processor(_Total)\% Processor Time"="50.762249"

processorTime50.762249

Is it possible? Thank you.

 

 

 

 

AskedSeptember 26, 2016 - 1:39pm

Answers (2)

Assuming you are using the im_winperfcount module to gather performance metrics on Windows then you don't need to do anything since the data will be available in custom fields as well, i.e. for the above exampe there will be a field as follows:

Processor(_Total)\% Processor Time: 50.762249

You might want to rename this of course.