I had to convert this comment into another answer (so I could insert pictures) to address your other questions. I am assuming you have admin rights to your Splunk.
1.) For the first part, if you are presented with a value of spaces between the brackets, you could simply add a | search yourfield!=" " at the end of your search, which filters out any value with a space in it.
2.) Yes, you can turn this into an extracted field without using props.conf and/or transforms.conf by doing it entirely in the GUI... and for the second part (making a multivalue field split) you can create a calculated field.
Go to Settings > Fields > Field Extractions > New
If you don't have a specific app you're working in, leave that as its default value.
Insert a name for your extraction, the sourcetype where the data resides, and insert the regex from the search excluding the double quotes, like this:
Save it.
When you save it, you'll be taken back to a section where you can search through other field extractions. Search the name of the field extraction you just created. You will need to change the permissions on it for other apps and/or for other people to see/use it.
Under the sharing column, click permissions.
Where it says "Object should appear in", either change it to "This App" or "Global". If you choose This App, the object will only be available to use in the current app (which is probably the Search app). If you choose Global, it will become a global object available in all apps. Use your discretion as to which roles you'd like to assign read or write permissions to. I usually select read for everyone, and admin for write, but I don't know what kind of environment you're working in.
Once you save it, now you'll need to go to Settings > Fields > Calculated fields
Click New, follow the similar format to the field extractions, and fill in the values.
This time, you're going to insert the eval expression split(yourfield,",")
Click save, make sure you change your permissions of the calculated field to the same permissions you gave your field extraction.
From here, to apply your extractions and make them visible for use, you can either:
Restart your search head
or
type into the search bar |extract reload=true and then in your address bar of your browser do a debug refresh SearchHeadURL:8000/en-US/debug/refresh and press refresh button - wait for it to complete. I usually do both because for whatever reason one or the other doesn't always work by itself. What this does is force a refresh on splunkd resources.
Now, you should be able go to where your data resides and simply type in index=yourIndex sourcetype=yourSourcetype and see yourfield under "interesting fields"
Lastly, as with this topic and any other question, make sure to accept the answer(s) so others know the question was answered 🙂
Hope that helps!
Try this:
| rex field=_raw "\[(?P<yourfield>.[^\]]*)"
| makemv delim="," yourfield
Worked for me:
