I have a search criteria with extraction, It seems to be extracting the value. But it's showing up in it's own column.      index=moogsoft "Return from ServiceNow (" | rex "Return from ServiceNow \((?<delay>\d+) seconds\)"     In the results page, I am only seeing the timestamp, the event, the extracted delay variable below the event. How do I display so the delay shows up in it's own column next to the event.     ... View more

Hi: I have logs that is delimited by ||. I would like to extract nth value from each log and group them by value and count.  I am fairly new to Splunk. This is how far I have gotten.      index=<index> INSERT OR UPDATE | eval fields=split(_raw,"||") | <WHAT DO I NEED HERE> | stats count by <field_value> | sort -count     My data     INSERT||"test Identifier"||"hostname"||"192.168.2.1"||"This is a test log"||....           ... View more