topic How to extract the key value pairs? in All Apps and Add-ons

How to extract the key value pairs?

santhgates — Wed, 21 May 2014 13:26:01 GMT

Below is an example of my event:

Timestamp="05/18/14 11:25:16 AM PDT" SessionIndex="2" Action="STATSDAILY" Version="2.1.10" Platform="Android" Device="HTC One" Params="{coinsEarned : 1800,coinsSpent : 1100,experienceEarned : 2460,timeSpent : 4417,diamondsEarned : 3,diamondsSpent : 18,noOfSessions : 4,energySpent : 7,gamesCompleted : 5}"

In the above event, in the field "Params", I need to extract the keys as the fields and their values as values for the new fields. So a new field "coinsEarned" should be extracted and its value should be "1800" for this event. Similarly for all the key-value pairs in the field Params.

Can someone help me with the regular expression to get the desired results?

Re: How to extract the key value pairs?

jameshgibson — Wed, 21 May 2014 14:59:51 GMT

You can just add this to your search:

| extract pairdelim="\"{,}" kvdelim=":"

Re: How to extract the key value pairs?

santhgates — Wed, 21 May 2014 15:42:57 GMT

Perfect! You saved my day 🙂

Re: How to extract the key value pairs?

yonmost — Wed, 28 Sep 2016 06:39:37 GMT

I have a similar situation and this answer doesn't work for me. How does the extract command know to work on the Params field? It's not mentioned anywhere

Re: How to extract the key value pairs?

yonmost — Wed, 28 Sep 2016 07:50:03 GMT

Here is what worked for me:

| makemv tokenizer="([^,]+)," Params | mvexpand line
| rex field=Params "(?<key>[^{:]+) : (?<value>[0-9]+)"

Re: How to extract the key value pairs?

bnikhil0584 — Wed, 11 Apr 2018 23:49:43 GMT

How to extract something like all the key-value pairs in the field Params ?

Timestamp="05/18/14 11:25:16 AM PDT" SessionIndex="2" Action="STATSDAILY" Version="2.1.10" Platform="Android" Device="HTC One" Params={"coinsEarned":"1800","coinsSpent":"no coins spent","experienceEarned":"2460","timeSpent":"4417","}

I've tried this but no luck

...| extract pairdelim="\"{,}" kvdelim=":"

Thank in advance

Re: How to extract the key value pairs?

haraksin — Wed, 28 Jul 2021 00:19:43 GMT

I used the following to help with this at search time with key-value pairs that had space delimiters and = key delimiters:

| extract pairdelim=" " kvdelim="="

This also works when your KV pairs optionally have quotation marks for data that contains whitespace.

Re: How to extract the key value pairs?

mverma — Tue, 29 Apr 2025 02:11:36 GMT

As a matter of fact, one actually doesn't need to specify the field name, which contains all the key value pair.
I used following simple extract parameters:

| extract pairdelim="," kvdelim=":"

One doesn't need to escape "," as done in the first answer!