what is the easy way to split _raw column using comma delimiter and show in table

arkisa — Fri, 06 Jul 2018 17:23:01 GMT

I have the _raw data in the following format. I just need to split that data and show each value in a separate column. What's the best way to do that?

I,HAVE,SOME,COMMA,SEPARATED,VALUES

Re: what is the easy way to split _raw column using comma delimiter and show in table

somesoni2 — Fri, 06 Jul 2018 20:47:43 GMT

You can use IFX (Interactive Field Extractor) to extract your delimited fields and save them in config files (http://docs.splunk.com/Documentation/Splunk/7.1.1/Knowledge/ExtractfieldsinteractivelywithIFX) OR you can use various search command to do that inline in your search (http://docs.splunk.com/Documentation/Splunk/7.1.1/Search/Extractfieldswithsearchcommands)

topic Re: what is the easy way to split _raw column using comma delimiter and show in table in Getting Data In

what is the easy way to split _raw column using comma delimiter and show in table

Re: what is the easy way to split _raw column using comma delimiter and show in table