(Splunk 4.3.2, in case it makes a difference)
I'm using rex to extract a sequence of digits, and I'd like Splunk to treat it as a numeric field, rather than categorical - so the automatic summary data in the field list will give min, max, mean and stdev.
| rex field=_raw "Time=(?P<mytime>\d+)ms"
but field mytime shows up as (categorical) with no useful statistics.
Is there any way to make Splunk recognize this is actually a numeric field?