I have a field named **Source** which contains spaces.
*eg*:
index=myIndex |Source=My Source Value|ComponentValue=My Component Value
To make this field displayed in a table, I used the following command.
rex "Source=(?[\S\s]*),{15}"
For which, I get
-----------------------
Source
-----------------------
My
My Source Value
My
My
If I'm doing like:
rex "Source=(?[\S\s]*)" | table Source | rename Source as source
I get the value I require, but also the entire log as well.
*i.e*:
-----------------------
Source
-----------------------
My Source Value
index=myIndex |Source=My Source Value|ComponentValue=My Component Value
My Source Value
index=myIndex |Source=My Source Value|ComponentValue=My Component Value
Can someone please help how to achieve this?