Most of the ways to create new fields in Splunk involve regular expressions (sometimes referred to as regex). As mentioned in the Splunk documentation:
There are many books and sites dedicated to regular expressions, so we will only touch upon the subject here. The following examples are really provided for completeness; the Splunk web interface may suffice for most users.
Given the log snippet ip=1.2.3.4, let's pull out the subnet (1.2.3) into a new field called subnet. The simplest pattern would be the following literal string:
ip=(?P<subnet>1.2.3).4
This is not terribly useful ...