I have a field 'foo', it has a value like "data1_data2"
I'd like to make an Extracted Field that starts with the contents of 'foo', instead of the entire raw event
is that possible?
↧