All the fields that we have used so far were either indexed fields (such as host, sourcetype, and _time) or fields that were automatically extracted from key=value pairs. Unfortunately, most logs don't follow this format, especially for the first few values in each event. New fields can be created either using inline commands or through configuration.
Working with fields
A regular expression primer
Most of the ways to create new fields in Splunk involve regular expressions (sometimes referred to as regex). As mentioned in the Splunk documentation:
"Regex is a powerful part of the Splunk search interface, and understanding it is an essential component of Splunk search best practices"
There are many books...
