2018-07-19 02:05:13,901|3801531980313892|MA_SE|aabbcc|12121212|10|FGH|lOP|||EMAIL|KARTHI@GMAIL.COM|LEVEL2|12/22/2017|12/31/9999|FATAL|E0021|Member not found
Hello @karthi2809,
I did a bit of the rex to get you started.
| makeresults
| eval fields="2018-07-19 02:05:13,901|3801531980313892|MA_SE|aabbcc|12121212|10|FGH|lOP|||EMAIL|KARTHI@GMAIL.COM|LEVEL2|12/22/2017|12/31/9999|FATAL|E0021|Member not found"
| rex field=fields "^(?<datetime>[0-9- :,]+)\|(?<numFiled1>[0-9]+)\|(?<someTextField1>[A-Z_]+)\|(?<someTextField2>[a-z])"
Please start from the field extraction above to accomodate it with your events.
Hey@karthi2809,
You can try using field extractor and use | as delimiter and rename your fields extracted.
https://docs.splunk.com/Documentation/SplunkCloud/latest/Knowledge/ExtractfieldsinteractivelywithIFX
Let me know if this helps!!!
I am not using sourcetype to extract