Thanks for the update. I've tested my solution on 6.3 and it definitely works okay with month and years fields. But your method is just as good if you can adjust the input. ... View more

shows up in most events in the transaction. I thought of approaching with mvindex, and it seems to work best. ... View more

Also do note that you should be able to "Accept" more than one answer if more than one of them works. This would be totally appropriate in this case. ... View more

Amazing. Thanks so much 🙂 ... View more

I was looking for something like this: event | spath event | search event="Out of Stock" | rex mode=sed "s/(\\\\\")/\"/g" | rex field=body "\"recordtype\":(?[^,]+)," | eval body.recordtype = recordtype which is repeatable for each field ... View more