Getting Data In

How to split events into multiple events based on field a paricular string tag in raw log

raj_mpl
Path Finder

Hi All,
In search head for a single event I can see below kind of data (single event)

tag field1="123" field2="abc" field3="yes"
/tag
Sometext
tag field1="766" field2="hjh" field3="no"
/tag
Sometext
tag field1="103" field2="anc" field3="yes"
/tag
Sometext

In search head I can able to see field1 as a field but the values in that are storing randomly (above kind f events are there)
How to split the single event into multiple events based on string or field in above ?

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...