How can I apply split and regex TSV at the same time?

[max8006]

Hi,
I have logs separated by a tab. I have defined FIELD_DELIMITER=tab, INDEXED_EXTRACTIONS=tsv FIELD_NAMES etc in props.conf accordingly. I now need to extract more fields in one of the fields using regex. What is the most sensible and efficient way to do this? Is it possible to do this in props.conf at the same time when tsv splitting happening? Or is there only the possibility to use "rex field=" @ searchtime

BR
Max

[gcusello]

Hi @max8006,

I usually use INDEXED_EXTRACTIONS = csv in props.conf.

Then if I need to extract other fields as part of one already extracted field, I use a regex at search time, using the option "field" in the regex.

Ciao.

Giuseppe