Sorry. Use this. |rex field = _raw "^(?P<field1>.{12})\s(?P<field2>.{12})" ... View more

I'm sorry. I forgot the code sample setting. |rex field = _raw "^.{12}\s(?P<newfield>.{12})" ... View more

What about this? ^.{12}\s(?P.{12}) ... View more

What about this? | stats values(MessageKey) by host Or | chart count over host by MessageKey usenull=f ... View more