it display this error: Error in 'rex' command: Encountered the following error while compiling the regex '(?telco)': Regex: unrecognized character after (? or (?- ... View more

source="/var/log/va-router/vpn/vpn.log" This is the search i used for visualize data. In this search usually I got my telco in the field. So the in telco its provide information like Maxis , Digi, and Celcom. So when click on the telco it will display this field. But some how the telco is missing in this field from this search (* source="/var/log/va-router/vpn/vpn.log"). And because that "telco" field is missing I face the problem to extract the new field and show rex error. Hope you understand ... View more

![* source="/var/log/va-router/vpn/vpn.log" | rex "(?<Telco>telco)"][1] I'm sorry, I dont know how to do this one, before this my telco is display on the selected field and interesting field. Now I dont how to find the telco. ... View more

can i know where should i put 101010? ... View more

Thanks Colin for a good answer. Unfortunately I'm so beginner in splunk. Can you show me where I should put your code? ... View more