Field Creation ?

[rakesh_498115]

Hi.

I have created a rex for my field say . MSGID . can this be saved in splunk using Fields Manager.

my rex is

rex Field=MSGID "^(?...)"

can this UNIQUEID saved to my sourcetype as Field .??

[alacercogitatus]

There are a few ways to save this.

You can add it to your props.conf

[your_sourcetype]
EXTRACT-uniq = ^(?<uniqueid>...)

REF: http://docs.splunk.com/Documentation/Splunk/5.0/Knowledge/Createandmaintainsearch-timefieldextractio...

You can use the UI to add it. See the documentation here for information.
http://docs.splunk.com/Documentation/Splunk/5.0/Knowledge/Managesearch-timefieldextractions