Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

permanently extracting a field

$
0
0
Hi, I am using regex to extract a field. However, I need to make it permanent so that I don't have use regex in future searches. The regex is: rex field=message "(?(\w{5,3}\s+)+" I would really appreciate any help! I hope I've provided sufficient information.

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>