Any suggestions for the best function to use if I need to pull out a substring (a key=value pair to be exact) from my _raw, and put it at the beginning of the event?
In summary, trying to go from:raw=,<my_KV_pair>, to:raw=<my_KV_pair>,
Use the Mask function, make it three parts, the stuff before your target, the part youre targeting, everything after. If your _raw has multiple lines, be sure to check the ‘s flag.
Match: (first part)(middle part)(last part)
(first part)(middle part)(last part)