I have a CSV with a fields Recipient, Sender, File name..etc which is currently set to be monitored from a remote machine (Splunk forwarder installed). The recipient field contains values like these:
abc@test.co.uk, efg@mail.com
rge@abc.com
abc@test.co.uk, efg@mail.com
The parser is capturing the values, but when it comes to multiple recipients, it's taking the whole column as single value. For example: abc@test.co.uk, efg@mail.com as single value.
If I do a stats count by Recipients, I get this:
abc@test.co.uk, efg@mail.com
rge@abc.com
But I want it to extract the emails separately which will should look like this when I do a stats count:
abc@test.co.uk
rger@abc.com
efg@mail.com
Any suggestions?
