Is it possible to use the rex command to do a dynamic key=value extraction where they key is a also a regular expression?
I know this can be done with a transform using:
REGEX = (,*?)=(.*?)
FORMAT = $1::$2
Can I do the same thing using rex instead? Maybe something like:
rex field=_raw "(?P<\\FIELDNAME>.*?)=(?<\\VALUE>.*?)"
Is their something I'm missing in the group naming syntax?
I'm looking for a way to do this at search-time rather than index-time without writing a transform.
... View more