When defining fields, it is often convenient to build the pattern directly in the query and then copy the pattern into the configuration. You might have noticed that the test in the Extract Fields workflow used rex.
Let's turn the subnet pattern we built earlier into a field. First, we build the query with the rex statement:
sourcetype="impl_splunk_gen" ip="*"| rex "ip=(?P<subnet>\d\.\d\.\d+)\.\d+"| table ip subnet
Since we know there will be an ip field in the events which we care about, we can use ip="*" to limit the results only to events that have a value for that field.
The table command takes a list of fields and displays a table, one row per event:
As we can see, the rex statement doesn't always work. ...
