Hello I have a basic search that I am running from the following:
index=sso
This search returns a lot of events. Within those log events, I would like to extract two pieces of information and create fields for them both, they are:
"saml:Issuer" AND "saml:Audience>https://"
I'd then like to run a simple query against these two new fields
index=sso sourcetype="pingfed*"
table saml:Issuer saml:Audience>https://
What would be the most efficient way of doing this field extraction step-by-step?
