Thanks @mayrr98 but this is not working. I want to get the data from the "tag variable" and store it
search source="c:\\splunk monitors\\log(2).txt" | head 1 | rex field=_raw "^[^\[\n]*\[(?P<SvcTag>[^\]]+)" | eval tag = SvcTag | return $tag
... View more