I assume that Splunk already gives you msg as a field. You can then use extract on it. index=wf_pvsi_other wf_id=swbs wf_env=prod sourcetype="wf:swbs:profiling:txt"
| rename msg as _raw
| extract
| search AppBody=SOR_RESP DestId=EIW
| table SrcApp, SubApp, RefMsgNm, DestId, MsgNm
| fillnull value=NA SubApp
| top SrcApp, SubApp, RefMsgNm, DestId, MsgNm limit=100
| rename SrcApp as Channel, SubApp as "Sub Application", RefMsgNm as Message, DestId as SOR, MsgNm as "SOR Message"
| fields Channel, "Sub Application", Message,SOR,"SOR Message",count
| sort Channel,"Sub Application", Message,SOR, "SOR Message", count (As your new source is JSON, overriding _raw should be fine.) Hope this helps.
... View more