Hi @vashodha  Yes. Data extracted using rex in the search time will only be available for the search. You need to follow series of steps based on your Splunk solution for creating fields at Index time. Please refer the below article. Create custom fields at index time - Splunk Documentation ... View more

Try this rex "streamstart(?<myvariable>(.*)(?=streamstop))"   ... View more