Key value pair... in a key value pair

adepasquale — Thu, 05 Nov 2020 19:34:32 GMT

Assume I have this key value pair in splunk

uri_query=“client=safari&source=hp&ei=5k-kX56GMdGpytMPu7asyA0&q=random+search&oq=random+search&gs_lcp=ChFtb2JpbGUtZ3dzLXdpei1ocBADMgUIABDJAzICCAAyAggAMgIIADICCAAyAggAMgIIADICCAA6CAgAELEDEIMBOgIILjoICC4QsQMQgwE6BQguELEDOgUIABCxAzoICAAQsQMQyQM6BAgAEApQ1xNY6yNg-iVoAHAAeACAAUKIAY8GkgECMTOYAQCgAQGwAQA&sclient=mobile-gws-wiz-hp”

the uri parameters could be in any order. If I want to search for a specific value I’m forced to do something like

| search uri_query=“*sclient=mobile-gws-wiz-hp*”

this is very slow for obvious reasons

if I run

| search sclient=mobile-gws-wiz-hp

This is very fast, but includes results where this value might be in the refer field rather than the uri_query field.

is there a better way to do these needle in a haystack searches?

Re: Key value pair... in a key value pair

richgalloway — Thu, 05 Nov 2020 21:07:13 GMT

Here's a kludgy, untested way to parse the uri_query field.

topic Key value pair... in a key value pair in Getting Data In

Key value pair... in a key value pair

Re: Key value pair... in a key value pair