The tricky part is creating a field from an unknown number of arguments. Right now, I'm doing rex commands in SPL, but it'd be nice to use an eval or regular expressions to create this field in props/transforms.
Splunk 7.3.1 does allow eval in the props.conf files - https://docs.splunk.com/Documentation/Splunk/7.3.1/Knowledge/Configurecalculatedfieldswithprops.conf
However, I disagree with you on doing this in the conf files. Generally(and there is no official backing to this) you transform/mask/unmask/escape special chars/ have a regex which is frequently needed in the conf files.
As long as you pattern is same you can extract any number of the arguments using 1 regex in splunk web, try this
| rex field=_raw "\"+(?<extrct>.*?)\"" max_match=0
| nomv extrct
I daresay this is not frequently used field overall , considered in the index as a whole.
Interesting fields (default) only comes if it is in >=20% of the data. Think about it
You misunderstood - I wasn't questioning whether or not you can do eval in props. I didn't know about the max_match parameter - that certainly another way to do it. Currently, I'm using the following rex commands in SPL to get the field I want:
| rex field=_raw "a0=\"(?.*)"
| rex field=cmdline mode=sed "s/\"\sa\d=\"?/ /g"
| rex field=cmdline mode=sed "s/\"$//g"
For my use case, I disagree with you regarding conf files. I would still prefer to do this in a conf file, so the field is automatically created when I search. I plan to reference this field in multiple searches, so having these commands across every search does not scale well.