How to extract all my fields from the log?

[karthi2809]

2018-07-19 02:05:13,901|3801531980313892|MA_SE|aabbcc|12121212|10|FGH|lOP|||EMAIL|KARTHI@GMAIL.COM|LEVEL2|12/22/2017|12/31/9999|FATAL|E0021|Member not found

[poete]

Hello @karthi2809,

I did a bit of the rex to get you started.

| makeresults
| eval fields="2018-07-19 02:05:13,901|3801531980313892|MA_SE|aabbcc|12121212|10|FGH|lOP|||EMAIL|KARTHI@GMAIL.COM|LEVEL2|12/22/2017|12/31/9999|FATAL|E0021|Member not found" 
| rex field=fields "^(?<datetime>[0-9- :,]+)\|(?<numFiled1>[0-9]+)\|(?<someTextField1>[A-Z_]+)\|(?<someTextField2>[a-z])"

Please start from the field extraction above to accomodate it with your events.

[deepashri_123]

Hey@karthi2809,

You can try using field extractor and use | as delimiter and rename your fields extracted.
https://docs.splunk.com/Documentation/SplunkCloud/latest/Knowledge/ExtractfieldsinteractivelywithIFX

Let me know if this helps!!!

[karthi2809]

I am not using sourcetype to extract