https://community.splunk.com/t5/Splunk-Cloud-Platform/How-to-split-this-string-DF-R-Emails-with-words-O365-sent-to/m-p/601242#M1494 <P>Ciao&nbsp;</P> <P>Could you please help me split this string:&nbsp;DF - R - Emails with words (O365) sent to Personal&nbsp; Account (scored) (Data Exfil)&nbsp;<BR /><BR />I need the DF - R - Emails with words&nbsp;<BR />(O365)<BR />sent to personal account<BR />(scored)</P> <P>(data exfil)<BR /><BR />all to be split into their own fields</P> Thu, 09 Jun 2022 18:39:31 GMT Italy1358 2022-06-09T18:39:31Z https://community.splunk.com/t5/Splunk-Cloud-Platform/How-to-split-this-string-DF-R-Emails-with-words-O365-sent-to/m-p/601242#M1494 <P>Ciao&nbsp;</P> <P>Could you please help me split this string:&nbsp;DF - R - Emails with words (O365) sent to Personal&nbsp; Account (scored) (Data Exfil)&nbsp;<BR /><BR />I need the DF - R - Emails with words&nbsp;<BR />(O365)<BR />sent to personal account<BR />(scored)</P> <P>(data exfil)<BR /><BR />all to be split into their own fields</P> Thu, 09 Jun 2022 18:39:31 GMT https://community.splunk.com/t5/Splunk-Cloud-Platform/How-to-split-this-string-DF-R-Emails-with-words-O365-sent-to/m-p/601242#M1494 Italy1358 2022-06-09T18:39:31Z https://community.splunk.com/t5/Splunk-Cloud-Platform/How-to-split-this-string-DF-R-Emails-with-words-O365-sent-to/m-p/601304#M1502 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/245709">@Italy1358</a>,</P><P>yes, it should be easy, but you should share some sample of logs, highlighting the parts to extract.</P><P>Ciao.</P><P>Giuseppe</P> Fri, 10 Jun 2022 06:26:00 GMT https://community.splunk.com/t5/Splunk-Cloud-Platform/How-to-split-this-string-DF-R-Emails-with-words-O365-sent-to/m-p/601304#M1502 gcusello 2022-06-10T06:26:00Z