Field Extractions

[itsmevic]

Hello I have a basic search that I am running from the following:

index=sso

This search returns a lot of events.  Within those log events, I would like to extract two pieces of  information and create fields for them both, they are:

"saml:Issuer" AND "saml:Audience>https://"

I'd then like to run a simple query against these two new fields

index=sso sourcetype="pingfed*"

table saml:Issuer saml:Audience>https://

What would be the most efficient way of doing this field extraction step-by-step?

[richgalloway]

Please share some sample events.