I have the _raw data in the following format. I just need to split that data and show each value in a separate column. What's the best way to do that?
I,HAVE,SOME,COMMA,SEPARATED,VALUES
You can use IFX (Interactive Field Extractor) to extract your delimited fields and save them in config files (http://docs.splunk.com/Documentation/Splunk/7.1.1/Knowledge/ExtractfieldsinteractivelywithIFX) OR you can use various search command to do that inline in your search (http://docs.splunk.com/Documentation/Splunk/7.1.1/Search/Extractfieldswithsearchcommands)