1 comment

  • Avatar
    Paulo Baptista
    OK a dug into it a bit.... and was happy with the "split" operator and parse regex | split _raw delim='|' extract date, x, x1, x2 as url, x3, x4, x5, x6, username, x6, x7, x8, x9, x10 | parse regex "(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"
    Comment actions Permalink

Please sign in to leave a comment.