Hi,
I have a raw_data as below
[APP=XYZ] [m=ServiceName.MethodName] [SLA=100]
Splunk already generated a filed with the name 'm".
I want to split this field into two separate fields(m1 & m2) as below
m1=ServiceName
m2=MethodName
Could anyone help me to do so ?
without knowing what the data actually looks like, you could try this in the search string:
|rex field=m "(?<m1>.*)\.(?<m2>.*)"
if you would like this to be automatically extracted, you could add the extraction if you are an admin. look over this doc:
http://docs.splunk.com/Documentation/Splunk/7.1.0/Knowledge/Managesearch-timefieldextractions
without knowing what the data actually looks like, you could try this in the search string:
|rex field=m "(?<m1>.*)\.(?<m2>.*)"
if you would like this to be automatically extracted, you could add the extraction if you are an admin. look over this doc:
http://docs.splunk.com/Documentation/Splunk/7.1.0/Knowledge/Managesearch-timefieldextractions
Thank you cmerriman :). It worked for me