A client wishes to pull some data from one of their logs into a search-time-extracted field and prefix it with a bit of text.
However, I know that
doesn't work, nor does adding any other text into FORMAT. (It will come out as literally what you typed, not with the value of $1.) Looking at regex sites, it doesn't appear possible to get something into a capture group that doesn't actually exist in the event.
Is there any way to add knowledge by concatenation onto a search-time field with props/transforms, without use of the search commands (such as eval)? Concatenation of two extracted fields perhaps?
asked 27 Jan '11, 01:49
There is not, and if you did, it would not be possible to search for the field values (in current versions, 4.1.6 and down). Note a search like
You could do something like create an automatic scripted lookup if you like instead, though it must output to a different field name from the input.
answered 27 Jan '11, 03:48