All,
Can you explain how the underscore is treated by Splunk? I see they are dropped at search times.
I am seeing a log that has
_message="some words"
But its extracted as automatically
message=""
Would there eve any value in me fixing _message to message at index time?
↧