Split _raw column

resparis · ‎07-04-2013

Hi., I have the following information in the _raw column.
Jul 4 15:41:10 name.domain.net Jul 04 2013 14:41:10: %ASA-1-106021: Deny UDP reverse path check from 172.16.3.62 to 255.255.255.255 on interface inside

Is there a way to separate the information and then create a table?

Gilberto_Castil · ‎07-04-2013

The most efficient way to accomplish this is to load the Technology Add-on for Cisco ASA from Splunkbase.

Split _raw column

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

Announcing Modern Navigation: A New Era of Splunk User Experience

Detection Engineering Office Hours: Real-World Troubleshooting & Q&A

Join the Conversation

Split _raw column

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

Announcing Modern Navigation: A New Era of Splunk User Experience

Detection Engineering Office Hours: Real-World Troubleshooting & Q&A