I can write a custom field extractor that works on the search-head but having problems with the auto portion. Since w3c is variable and can have a user defined list of fields I am trying to get the auto function to work. I think this will read a commant field and use that to define the search time extractions. This is what is written currently in the test environment. Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status time-taken Running a search i can see the data is there, but the fields are not indexed properly. 2018-02-15 16:18:59 ::1 GET /welcome.png - 443 - ::1 Mozilla/5.0+(Windows+NT+6.1;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/63.0.3239.132+Safari/537.36 200 0 0 8 The props.conf file I have is the one in default. I don't want to use a custom field extraction because I know my web developers will change stuff up on me and its not static across multiple iis environments. What am I missing ? JMJ ... View more

Is there any more documentation on how to use the jira.conf file? The documentation only says "Configure which keys to display in the table with the keys, time_keys, and custom_keys fields." I am running the command | jira issues 22618 | table Key Summary Assignee Created "Affected Systems" Assignee is coming out as a multi field value, all i really want is displayName. The following regex works | jira issues 22618 | rex field=Assignee ".\"name\": \"(?\w+)\""| rex field=Assignee ".\"displayName\": \"(?[^\"]+)\"," | table Assignee_userid Assignee_displayName Assignee Is this something I can configure with the jira.conf file or should I run the regex ? ... View more