Split _raw column

resparis · ‎07-04-2013

Hi., I have the following information in the _raw column.
Jul 4 15:41:10 name.domain.net Jul 04 2013 14:41:10: %ASA-1-106021: Deny UDP reverse path check from 172.16.3.62 to 255.255.255.255 on interface inside

Is there a way to separate the information and then create a table?

Gilberto_Castil · ‎07-04-2013

The most efficient way to accomplish this is to load the Technology Add-on for Cisco ASA from Splunkbase.

Split _raw column

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Mile High Learning with Splunk University, Denver, Colorado

IT Service Intelligence 5.0 Series: Your Guide to the June Launch

Agent Mode Engaged! Enchaining Agentic Operations with Splunk AI Assistant 2.0

Join the Conversation

Split _raw column

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Mile High Learning with Splunk University, Denver, Colorado

IT Service Intelligence 5.0 Series: Your Guide to the June Launch

Agent Mode Engaged! Enchaining Agentic Operations with Splunk AI Assistant 2.0