Is there any difference in performance when using
props.conf
EXTRACT-name1 = long (?<field1>regex) with lots of (?<field2>capture groups)
versus
props.conf
REPORT-name2 = transform_name
transforms.conf
[transform_name]
REGEX = long (regex) with lots of (capture groups)
FORMAT = field1::$1 field2::$2
?
Since they are both extracted by the same regex processor at search time, my educated guess would be no.
Due to tradition, style, and readability, I personally tend to use the transforms.conf specification.
Since they are both extracted by the same regex processor at search time, my educated guess would be no.
Due to tradition, style, and readability, I personally tend to use the transforms.conf specification.
REPORT also allows you to apply the same regex easily to multiple data types without having multiple copies of the regex around - another reason why I use it.
Thanks - so do I. But I was working up a regex on the search bar with rex yesterday and tossed it right in an EXTRACT - so I was wondering.