I am trying the field tranformation feature. using the "Manager » Fields » Field transformations" UI
I have defined the following transformation
regex=(?
key=_raw
format=
now I'm searching for aviad=* in search app and no event comes up. what gives?
You did not provide any field naming/mapping; try this:
regex=(?.) key=_raw format=aviad::$1