Split not working

[amitg_23]

I have following data after this query:

index=sdlocp_epo-solutiontest sourcetype="kube:container:customer-soap-app"
| spath
| search level="SERVICE_PERF"
| table message

|2800|BackOffice|T999999||Servcie1|8b81dbd0-ba0f-11e9-8912-914decccd432|Success|67|NA|NA|NA
|2800|BackOffice|T999999||Servcie1|8b81dbd0-ba0f-11e9-8912-914decccd432|Success|67|NA|NA|NA
|2800|BackOffice|T999999||Servcie1|8b81dbd0-ba0f-11e9-8912-914decccd432|Success|67|NA|NA|NA
|2800|BackOffice|T999999||Servcie2|8b81dbd0-ba0f-11e9-8912-914decccd432|Success|16|NA|NA|NA
|2800|BackOffice|T999999||Servcie2|8b81dbd0-ba0f-11e9-8912-914decccd432|Success|16|NA|NA|NA
|2800|BackOffice|T999999||Servcie2|8b81dbd0-ba0f-11e9-8912-914decccd432|Success|16|NA|NA|NA

I then run the following query:

index=sdlocp_epo-solutiontest sourcetype="kube:container:customer-soap-app"
| spath
| search level="NG_SERVICE_PERFORMANCE"
| table message
| eval fields=split(message,"|") , etime=mvindex(fields,8)
| table etime

It fails.

When I run it with _raw instead of message in split, it works. Why is that so?

I am using logs in JSON format.

Thanks in advance.

[amitg_23]

Sorry, second query is:
index=sdlocp_epo-solutiontest sourcetype="kube:container:customer-soap-app"
| spath
| search level="SERVICE_PERF"
| table message
| eval fields=split(message,"|") , etime=mvindex(fields,8)
| table etime

[mayurr98]

I am not sure why its not working because the syntax looks perfect. Do you get any error?

Well you could use rex to get the desired result.

index=sdlocp_epo-solutiontest sourcetype="kube:container:customer-soap-app"
| spath 
| search level="SERVICE_PERF" 
| table message 
| rex field=message "\|\w+\|(?<etime>\d+)\|"
| table etime

let me know if this helps!