Hi @Keith_NZ , at first, please in addition to the screenshots, add also the code and a sample of your logs in text format using the "Add/Edit Code sample" button. Then, if you are doing an extrac...
See more...
Hi @Keith_NZ , at first, please in addition to the screenshots, add also the code and a sample of your logs in text format using the "Add/Edit Code sample" button. Then, if you are doing an extraction from _raw you don't need to explicit it in field option. At least, your first rex expressio is almost correct, you have to declare the format of the field (e.g. if it's numeric you have to add \d, something like this, then you have to declare something to define the string to extract as field, e.g. to extract the postCode, you should use: rex "postCode\\\":\\\"(?<postCode>\d+)" in this specific case beware when you have backslashes because to use in Splunk you have to use an additional backslash. Instead isn't correct the last one: | rex field=_raw reg_str because it isn't a field extraction. Ciao. Giuseppe