Hi,
I'm ingesting the data in JSON format. we have a field event.user, which is auto extracted. is there a way to extract the new field user from event.user filed at indexing time?
for example:
event.user :
kiran331@SPl,
splunk@ADDS
I need to extract:
user:
kiran331
splunk
↧