How to break events while indexing

[moohkhol]

Hi,

I have events which logging user agents information,

USR_AGNT="Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36"

In the above log events, we have browser information as well as OS information, How i can transform it while indexing into two different key such OS_INFO (operating system related information) and BRW_INFO (Browser related information) under USR_AGNT.

[martin_mueller]

You can extract that information at search time as you normally would for any field. See http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Aboutfields for more.

Note, breaking events is a different thing - see http://docs.splunk.com/Documentation/Splunk/latest/Data/Indexmulti-lineevents for that.