The extract command will extract the fields from _raw. You could then use a where command to filter the events you want.
| makeresults
| eval _raw = "Created=\"2022-11-09 18:00:48 +00:00\" date to be change to date format 2022-11-09
Feb 5 22:00:28 centino03 729 <134>1 2023-02-06T03:00:05.982+00:00 centino03 centino 7824 - [centino-Discover@017474 id=\"252235\" MacAddress=\"42-01-0A-08-10-76\" MacOrganization=\"null\" \" HostName=\"MACRO-GPG0\" Labels=\"Lost Interface\" Computer-Name=\"fdsfaeds\"Locations=\"\" centinoComputerId=\"0\" Os=\"Windows\" OsGeneration=\"null\" Managed=\"0\" Unmanageable=\"0\" Arp=\"1\" Nmap=\"1\" Ping=\"1\" Connected=\"1\" AwsApi=\"0\" CentralizedNmap=\"0\" SatelliteNmap=\"0\" Created=\"2022-11-09 18:00:48 +00:00\" UpdatedAt=\"2023-02-06 02:41:53 +00:00\" FirstManaged=\"2022-12-18 04:01:02 +00:00\" LastManagedAt=\"2023-01-12 12:01:11 +00:00\" LastDiscoveredAt=\"2023-02-06 02:41:53 +00:00\" Profile=\"GCP_TnD_Subnets\" SatelliteDecId=\"null\" SatelliteName=\"null\"]"
| extract
