I have logs that do not use the default name value format for the "user" field. When I add a field extractor for my user format and name it "user" the default format of "user=" no longer is included in the search. How to I add to the existing field rule rather than replace it?
↧