How do I split _raw data into multiple table fields?

[slord]

I have the following data in _raw and I need to split the data at the semicolon into multiple fields in a table

LOG INPUT (_raw)

2018-08-22 10:45:19,834 ;Application 1;Status Known;SEARCH_STRING;APP_STATUS
2018-08-22 10:44:19,834 ;Application 2;Status Unknown;SEARCH_STRING;APP_STATUS
2018-08-22 10:43:19,834 ;Application 4;Status Offline;SEARCH_STRING;APP_STATUS
2018-08-22 10:42:19,834 ;Application 5;Status Known;SEARCH_STRING;APP_STATUS
2018-08-22 10:41:19,834 ;Application 3;Status Known;SEARCH_STRING;APP_STATUS
2018-08-22 10:40:19,834 ;Application 1;Status Offline;SEARCH_STRING;APP_STATUS

I want a table that looks like

Date                     | Application Name  | Status         | Search        | Ingore
2018-08-22 10:45:19,834  | Application 1     | Status Known   | SEARCH_STRING | APP_STATUS
2018-08-22 10:44:19,834  | Application 2     | Status Unknown | SEARCH_STRING | APP_STATUS
2018-08-22 10:43:19,834  | Application 4     | Status Offline | SEARCH_STRING | APP_STATUS
2018-08-22 10:42:19,834  | Application 5     | Status Known   | SEARCH_STRING | APP_STATUS
2018-08-22 10:42:19,834  | Application 3     | Status Known   | SEARCH_STRING | APP_STATUS
2018-08-22 10:41:19,834  | Application 1     | Status Offline | SEARCH_STRING | APP_STATUS

[horsefez]

Hi @slord,

you should rather go for the field extractor tool in splunk to extract out the fields you want. You do have an option to choose "delimiter" ";" as an option there.

[richgalloway · Accepted solution]

Use the rex command.

index=foo | rex "(?<Date>[^;]+)\s;(?<Application>[^;]+);(?<Status>[^;]+);(?<Search>[^;]+);(?<Ignore>.*)" | ...

[slord]

You are awesome, that worked ... thanks!

[richgalloway]

@slord, if your problem is resolved, please accept an answer to help future readers.