Hi,
Is it possible to use tokens in rex fields like this?
| rex "\d{1,2}-\S{3}\s\d{2}:\d{2}:\d{2}.\d{3}\s\S{3}\s\[(?<ip2>$spec_ip$)\]\s%NICWIN-4-Security_560_Security[\S\s]+?(?<log_time2>(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)\s\d{2}\s\d{2}:\d{2}:\d{2})[\S\s]+?\S*Object\sName:\s(?<object_name2>[\S\s]+?)New\sHandle\sID[\S\s]+?Primary\sUser\sName:\s(?<username2>[\S\s]+?)\s+"
I don't see why not - easy enough to test - just make a dashboard with a text input token spec_ip and see. See this
<form>
<label>test_ip</label>
<fieldset submitButton="false">
<input type="text" token="spec_ip" searchWhenChanged="true">
<label>IP format</label>
<default>\d+\.\d+\.\d+\.\d+</default>
</input>
</fieldset>
<row>
<panel>
<table>
<title>Parsing IP address with $spec_ip$ format</title>
<search>
<query>| makeresults
| eval IP=(random()%256).".".(random()%256).".".(random()%256).".".(random()%256)
| rex field=IP "(?<ip2>$spec_ip$)"
| eval format=$spec_ip|s$</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
</form>