<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Key Extract from data in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/Key-Extract-from-data/m-p/506765#M86253</link>
    <description>&lt;P&gt;I have following logs&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;2020-06-30 17:58:28,307; thread=[workflow-503]; LogLevel=INFO; class=a.b.c.getData; milestone_end; id=asddd_ddd_ddd0, key1=193514641285449, tid=60d06-26c3-4281-8600-79338c6, flow=MessageMatching, RecordsCount=0, appId=appid1; msg=PerfStat-Repository: solrQuery={“q”:”a_id:193514641285449 AND (status:TO_BE_REVIEWED AND transaction_source:(SOURCE_A) AND amount:\\-80.00) AND -(deleted:true) AND -(is_primary:false)","start":"0","route.partition":["193514641285449"],"timeAllowed":10000}; recordCount=0; elapsedTime=3;; ​&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Here we have solrQuery of the form {"q":"key1:value1 AND key2:value2 AND (key3:value3)};&lt;/P&gt;&lt;P&gt;I want to extract only key in the format key1,key2,key3&lt;/P&gt;</description>
    <pubDate>Tue, 30 Jun 2020 18:14:46 GMT</pubDate>
    <dc:creator>deepak1037</dc:creator>
    <dc:date>2020-06-30T18:14:46Z</dc:date>
    <item>
      <title>Key Extract from data</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Key-Extract-from-data/m-p/506765#M86253</link>
      <description>&lt;P&gt;I have following logs&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;2020-06-30 17:58:28,307; thread=[workflow-503]; LogLevel=INFO; class=a.b.c.getData; milestone_end; id=asddd_ddd_ddd0, key1=193514641285449, tid=60d06-26c3-4281-8600-79338c6, flow=MessageMatching, RecordsCount=0, appId=appid1; msg=PerfStat-Repository: solrQuery={“q”:”a_id:193514641285449 AND (status:TO_BE_REVIEWED AND transaction_source:(SOURCE_A) AND amount:\\-80.00) AND -(deleted:true) AND -(is_primary:false)","start":"0","route.partition":["193514641285449"],"timeAllowed":10000}; recordCount=0; elapsedTime=3;; ​&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Here we have solrQuery of the form {"q":"key1:value1 AND key2:value2 AND (key3:value3)};&lt;/P&gt;&lt;P&gt;I want to extract only key in the format key1,key2,key3&lt;/P&gt;</description>
      <pubDate>Tue, 30 Jun 2020 18:14:46 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Key-Extract-from-data/m-p/506765#M86253</guid>
      <dc:creator>deepak1037</dc:creator>
      <dc:date>2020-06-30T18:14:46Z</dc:date>
    </item>
    <item>
      <title>Re: Key Extract from data</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Key-Extract-from-data/m-p/506776#M86255</link>
      <description>To clarify, you want to extract "a_id", "status", "transaction_source", "amount", "deleted", "is_primary", "start", "route.partition". and "timeAllowed" as fields, correct?&lt;BR /&gt;Is the solrQuery field already extracted?&lt;BR /&gt;Do you want the keys extracted at index time or search time?</description>
      <pubDate>Tue, 30 Jun 2020 19:18:24 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Key-Extract-from-data/m-p/506776#M86255</guid>
      <dc:creator>richgalloway</dc:creator>
      <dc:date>2020-06-30T19:18:24Z</dc:date>
    </item>
    <item>
      <title>Re: Key Extract from data</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Key-Extract-from-data/m-p/506782#M86256</link>
      <description>&lt;P&gt;&lt;SPAN&gt;To clarify, you want to extract "a_id", "status", "transaction_source", "amount", "deleted", "is_primary", "start", "route.partition". and "timeAllowed" as fields, correct?: Yes&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;Is the solrQuery field already extracted? No&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;Do you want the keys extracted at index time or search time? Didn't get that&lt;/SPAN&gt;&lt;/P&gt;</description>
      <pubDate>Tue, 30 Jun 2020 20:34:03 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Key-Extract-from-data/m-p/506782#M86256</guid>
      <dc:creator>deepak1037</dc:creator>
      <dc:date>2020-06-30T20:34:03Z</dc:date>
    </item>
  </channel>
</rss>

