https://community.splunk.com/t5/Splunk-Search/Need-to-extract-field-while-search-only-dont-want-to-use-field/m-p/458589#M191281 <P>Hi, <BR /> I have diff log formats in a single sourcetype. Thus can't define field extraction - is there way to use REX in the search string itself which creates fields.?<BR /> My log looks like this - <BR /> Aug 21 20:44:38, ip-10-237-103-12.ec2.internal, vehicle-master-stg, LOG_MESSAGE: </P> Wed, 21 Aug 2019 20:54:22 GMT rashi83 2019-08-21T20:54:22Z https://community.splunk.com/t5/Splunk-Search/Need-to-extract-field-while-search-only-dont-want-to-use-field/m-p/458589#M191281 <P>Hi, <BR /> I have diff log formats in a single sourcetype. Thus can't define field extraction - is there way to use REX in the search string itself which creates fields.?<BR /> My log looks like this - <BR /> Aug 21 20:44:38, ip-10-237-103-12.ec2.internal, vehicle-master-stg, LOG_MESSAGE: </P> Wed, 21 Aug 2019 20:54:22 GMT https://community.splunk.com/t5/Splunk-Search/Need-to-extract-field-while-search-only-dont-want-to-use-field/m-p/458589#M191281 rashi83 2019-08-21T20:54:22Z https://community.splunk.com/t5/Splunk-Search/Need-to-extract-field-while-search-only-dont-want-to-use-field/m-p/458590#M191282 <P>Fix your sourcetypes before doing anything else. This will get much worse down the road</P> Wed, 21 Aug 2019 23:42:34 GMT https://community.splunk.com/t5/Splunk-Search/Need-to-extract-field-while-search-only-dont-want-to-use-field/m-p/458590#M191282 skoelpin 2019-08-21T23:42:34Z