Is there any difference in performance when using
EXTRACT-name1 = long (?<field1>regex) with lots of (?<field2>capture groups)
REPORT-name2 = transform_name
REGEX = long (regex) with lots of (capture groups)
FORMAT = field1::$1 field2::$2
Since they are both extracted by the same regex processor at search time, my educated guess would be no.
Due to tradition, style, and readability, I personally tend to use the transforms.conf specification.
View solution in original post
REPORT also allows you to apply the same regex easily to multiple data types without having multiple copies of the regex around - another reason why I use it.
Thanks - so do I. But I was working up a regex on the search bar with rex yesterday and tossed it right in an EXTRACT - so I was wondering.