Split a single field into two fields

[Allampally]

Hi,

I have a raw_data as below
[APP=XYZ] [m=ServiceName.MethodName] [SLA=100]
Splunk already generated a filed with the name 'm".
I want to split this field into two separate fields(m1 & m2) as below
m1=ServiceName
m2=MethodName

Could anyone help me to do so ?

[cmerriman · Accepted solution]

without knowing what the data actually looks like, you could try this in the search string:

|rex field=m "(?<m1>.*)\.(?<m2>.*)"

if you would like this to be automatically extracted, you could add the extraction if you are an admin. look over this doc:
http://docs.splunk.com/Documentation/Splunk/7.1.0/Knowledge/Managesearch-timefieldextractions

[Allampally]

Thank you cmerriman :). It worked for me