Actually its from that app which I need from. I need the first strings into a field named type. Also looking for regex without using multikv so that i could create that field. ... View more

Thank you for your reply.Now i get all the values into type field as below TOP NETSIZE DISKRIO DISKWIO DISKRXFER DISKWRITE DISKXFER But once i get values can i search by each type? Below query doesnt seem to work ..can someone help me with this? For example: index=os sourcetype="nmon" |rex "(?m)^(?P([A-Za-z])[^,]+)" max_match=0|search type=NETSIZE ... View more