Can a field extraction be devised so that it has a default value when the regex is not matched?
I have defined an extracted field based on a regex which matches a specific pattern in an event. The resulting field will contain the matched data if it was present and the field will not exist for an event where the pattern was not matched.
All that is good.
However, for the cases where the pattern did not match, I would rather the field exist and contain a hyphen ("-").
Within the confines of a field extraction, is there a way to do this? I know I could use fillnull to add the hyphens later, but I'd prefer a more elegant solution.
In no solution exists, I can live with it, but if I can have this, it would streamline my searching.
Thanks!
... View more