Hi Folks, I have a quick question. currently I have a syslog event and I need to see in splunk the raw data the info in different order: Example original syslog (?<field1>REGEX),(?<field2>REGEX),(?<field3>REGEX), etc....... what I want to see indexed in splunk (?<field1>REGEX),(?<field3>REGEX),,(?<TIMESTAP>REGEX),(?<field2>REGEX). I tried with SED command in props.conf is really useful to clean the data but not to reorder the info. Thanks in advance Alex
... View more
