I have an event log that looks like this
Hi @Mostafa3081,
let me understand: you want to extract a part of a field in a summary index, is it correct?
If this is your requirement and if you can, the easiest way is to save the field to extract in the summary generating search.
Anyway, you can extract the part of the "text" field using a rex command:
| rex field=text "href\=\\\"(?<url>[^ ]*)"
that you can test at https://regex101.com/r/6jptux/1
Ciao.
Giuseppe
thanks for your replay.
No, I want the exact opposite. I want to extract the entire text value. I received a truncated version, and I can use regex to extract the complete value. However, why did the value get truncated when retrieved from a summary index but not from the normal index?