About Rabbit

Rabbit · ‎07-25-2021

Thanks for the quick reply But queries return nothing if in event part is added at the end of the line, after removing it they start working again. btw, I tried to put entire Regex in quotes then in event part (as u can see in screenshot), and w/o quotes but nothing changed.

Rabbit · ‎07-24-2021

We're planning to have custom fields so people can directly search by those fields. Field Extraction works well only concern of mine is not able to specify the fields which can cause performance difficulties. I assume there is a difference between parsing from only the event versus from entire _raw. Also, I don't want to force developers to use back tick character for macro(s).

Rabbit · ‎07-24-2021

in search, w/ rex command I can specify which field I want to apply the Regex as following example | rex field=event "My Custom regex...." But if I want to register the same regex in Field Extraction option (to have it reusable object w/ my team) I don't see any option to specify the field. I assume it register it to entire _raw as default. Any idea if I can specify the field when I create a Field with "Field Extraction" ?

Posts	3
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎07-24-2021

Online Status	Offline
Date Last Visited	‎07-25-2021 10:21 PM

specifying field in Field Extraction

Re: specifying field in Field Extraction

Re: specifying field in Field Extraction

specifying field in Field Extraction