When using the Field Extractor can you use the same name for a field? will it append or add to the original field create
Example
I am extracting from the _raw data
Found that some of the _raw data didn't match when I highlight when using regex match
I was getting the red x as the example below, that should of captured it since both logs are identical in patterns.
So I extracted twice on a single field on two data sets.
will it append? And add it onto the field of data to look for?
Hi @Cheng2Ready
If you apply multiple field extractions then the one with the highest precedence will be used, instead you may wish to manually modify the regular expression to cover both events.
When extracting the fields using the field extractor wizard, on the "Select fields" step, select the "Show regular expression" text as below:
This then allows you to click "Edit regular expression" button on the right, and clicking this gives you the regex which you can override.
At this point you should define a regex that matches all the relevant events.
If you need help creating the regex please post raw examples/samples of the events and I'd be happy to help.
🌟 Did this answer help you? If so, please consider:
- Adding karma to show it was useful
- Marking it as the solution if it resolved your issue
- Commenting if you need any clarification
Your feedback encourages the volunteers in this community to continue contributing
Hi @Cheng2Ready
If you apply multiple field extractions then the one with the highest precedence will be used, instead you may wish to manually modify the regular expression to cover both events.
When extracting the fields using the field extractor wizard, on the "Select fields" step, select the "Show regular expression" text as below:
This then allows you to click "Edit regular expression" button on the right, and clicking this gives you the regex which you can override.
At this point you should define a regex that matches all the relevant events.
If you need help creating the regex please post raw examples/samples of the events and I'd be happy to help.
🌟 Did this answer help you? If so, please consider:
- Adding karma to show it was useful
- Marking it as the solution if it resolved your issue
- Commenting if you need any clarification
Your feedback encourages the volunteers in this community to continue contributing
