Hi,
I have events which logging user agents information,
USR_AGNT="Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36"
In the above log events, we have browser information as well as OS information, How i can transform it while indexing into two different key such OS_INFO (operating system related information) and BRW_INFO (Browser related information) under USR_AGNT.
You can extract that information at search time as you normally would for any field. See http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Aboutfields for more.
Note, breaking events is a different thing - see http://docs.splunk.com/Documentation/Splunk/latest/Data/Indexmulti-lineevents for that.