A custom parking-meter syslog buries the meter ID in the raw message. The analyst needs that ID as a field for later stats. Which command extracts it in the search?
Select an answer to reveal the explanation.
Short Explanation
The meter ID is hiding in the syslog sentence like a ticket number in a paragraph. rex is the highlighter that pulls it into a real field so stats can count. No CIM model is going to guess that custom string.
Full Explanation
rex extracts fields with regular expressions from _raw, or another field, during search. Custom civic sourcetypes such as parking-meter syslog often bury identifiers that are not yet CIM fields. tstats, transaction, and an empty lookup do not perform that extraction. The extracted field can then be used in stats for the investigation.