What I meant by columns was referring to the actual logs. index = hrfarm | rex "^(?:[^ ]* ){2}(? [^ ]+)\s" 2013-05-13 17:32:26,962 C083363 /* GUID: C083363 */ select permission1_.PermissionId as col_0_0_ from... Rex command works just not the correct position and when I change the position to either {1} or {3} its still not correct. Interesting field "account_ID" position {2} returns: GUID: or sometimes commands: position {1} returns: 2013-05-13 17:32:26,962 C083363 position {3} returns: GUID: C083363 (close but I want the first account ID value) ... View more

Something is still not right. The rex command is very close to what I'm looking for but it looks like timestamp and account ID are being identified as column 1. Right now: 2013-05-13 15:00:00,000 C012345 = Column 1 Should be: 2013-05-13 15:00:00,000 = Column 1 C012345 = Column 2 I'm still fairly new to Splunk so what can I do to separate timestamp from account ID first before I can apply the rex command? Thank you! ... View more