Hi.
I have created a rex for my field say . MSGID . can this be saved in splunk using Fields Manager.
my rex is
rex Field=MSGID "^(?
can this UNIQUEID saved to my sourcetype as Field .??
There are a few ways to save this.
You can add it to your props.conf
[your_sourcetype]
EXTRACT-uniq = ^(?<uniqueid>...)
You can use the UI to add it. See the documentation here for information.
http://docs.splunk.com/Documentation/Splunk/5.0/Knowledge/Managesearch-timefieldextractions