topic Re: Splunk Fields Extraction in Splunk Dev

Splunk Fields Extraction

kunalsingh — Thu, 24 Apr 2025 10:46:33 GMT

I have used this regex -

\^([^=]+)=([^^]*)

Apr 23 21:43:22 3.111.9.101 CEF:0|Seqrite|EPS|5.2.1.0|Data Loss Prevention Event|^|channelType=Applications/Online Services^domainName=AVOTRIXLABS^endpointName=ALEI5-ANURAGR^groupName=Default^channelDetail=Microsoft OneDrive Client^documentName=^filePath=C:\Users\anurag.rathore.AVOTRIXLABS\OneDrive - Scanlytics Technology\Documents\git\splunk_prod\deployment-apps\Fleet_Management_Dashboard\appserver\static\fontawesome-free-6.1.1-web\svgs\solid\flask-vial.svg^macID1=9C-5A-44-0A-26-5B^status=Success^subject=^actionId=Skipped^printerName=^recipientList=^serverDateTime=Wed Apr 23 16:13:57 UTC 2025^matchedItem=Visa^sender=^contentType=Confidential Data^dataId=Client Application^incidentOn=Wed Apr 23 16:07:38 UTC 2025^ipAddressFromClient=***.***.*.16^macID2=00-FF-58-34-31-0E^macID3=B0-FC-36-CA-1C-73^userName=anurag.rathore

it is able to extract all field correctly Except a few fields .
Here documentName should be empty but it is showing this on search time.

Re: Splunk Fields Extraction

gcusello — Sat, 26 Apr 2025 16:21:52 GMT

Hi @kunalsingh ,

please try this:

\^([^\=]+)=([^\^]*)

Ciao.

Giuseppe

Re: Splunk Fields Extraction

livehybrid — Sat, 26 Apr 2025 21:13:32 GMT

Hi @kunalsingh

Use a REPORT transform in props.conf and transforms.conf to define the field extractions based on your delimiters.

==props.conf==
[your_sourcetype]
# Replace your_sourcetype with the actual sourcetype of your data
REPORT-kv_pairs = extract_custom_kv

==transforms.conf==
[extract_custom_kv]
REGEX = ([^=\^]+)=([^\^]*)
FORMAT = $1::$2
MV_ADD = true

This configuration defines a field extraction named extract_custom_kv.

REGEX = ([^=\^]+)=([^\^]*): This regular expression finds key-value pairs separated by =.
([^=\^]+) captures the key (any character except = or ^).
= matches the literal equals sign.
([^\^]*) captures the value (any character except ^, including an empty string). This correctly handles fields like documentName= where the value is empty.
FORMAT = $1::$2: This assigns the captured key (group 1) and value (group 2) to a Splunk field.
MV_ADD = true: Ensures that if multiple key-value pairs are found in a single event, they are all extracted.

Check a working example at https://regex101.com/r/yAjRVa/1

This method correctly identifies the ^ character as the delimiter between pairs and = as the separator within a pair, handling empty values appropriately. The regex you provided, ^([^=]+)=([^^\]), likely failed because the ^ anchor restricts it to the start of the string, and the character class [^^\*] might not behave as expected compared to [^\^].

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Splunk Fields Extraction

gcusello — Sun, 27 Apr 2025 07:41:34 GMT

Hi @kunalsingh ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉