Any reason why my statement for props.conf isn't showing up as an extracted field?
EXTRACT-kls_error = (?(kls_error_*)\w+)
When I use just the rex in a search it gets the exact info that I need but when I am trying to create an extracted field it cannot
↧
