Hello,
I currently have a field that contains a long string over 100+ events and in that field there are varying file sizes (609.9 KB, 1GB, 300B, etc.). What I would like to do is come up with an eval or rex command that will pull out only the file sizes and place them into a new field called File_Size. I tried using the field extractor via the GUI, but it would only pick up a couple of the file sizes and even then still wouldn’t show up in the available fields of my search. I’ve also tried creating different queries, but can’t seem to get capture groups set correctly. Can someone please advise on best approach?
... View more