Thank you @davidveuve  for the solution , was searching from a long time . Also i was wondering how did you came to observe this behavior of AOB. ... View more

@prashant_kumar_  use this transforms [hostoverride] REGEX = hostname\"\:\"(.*)\" DEST_KEY = MetaData:Host FORMAT = host::$1 props.conf  [override] TRANSFORMS-ooo = hostoverride INDEXED_EXTRACTIONS = json DATETIME_CONFIG = CURRENT LINE_BREAKER = ([\r\n]+) NO_BINARY_CHECK = true disabled = false pulldown_type = true my test file  {"geo":"NA","city":"UK","country":"London","hostname":"lp5cd8213yt4"}      ... View more

@anilbabuk  | eval TT=File."-".User | fields - File User | chart count over TT by Date | eval File=mvindex(split(TT,"-"),0) | eval User=mvindex(split(TT,"-"),1) | fields - TT | table File User * ... View more

Thanks @niketn  for this walkthrough ... View more

You can used spath also.You will get two fields.Use eval to concatenate the two fields. ... View more

If you are explicitly looking for faultstring tag only then the following regex should work. (?.*)<\/faultstring> ... View more