https://community.splunk.com/t5/Knowledge-Management/Get-event-into-kvpairs/m-p/364055#M5199 <P>I have this event:</P> <PRE><CODE>2017-06-26|20:37:56.551 [Thread-26] INFO [InsertCache.java:56] - InsertCache Stats: getTagCacheHits() = 191891 getTagCacheMisses() = 14 getBucketCacheHits() = 191879 getBucketCacheMisses() = 26 getIntervalCacheHits() = 186294 getIntervalCacheMisses() = 5611 getVersionCacheHits() = 186294 getVersionCacheMisses() = 5611 getTotalCacheHits() = 756358 getTotalCacheMisses() = 11262 getTotalEvictionCount() = 10095 </CODE></PRE> <P>How would I get the KEY() = VALUE into nvpairs in splunk after*<STRONG>InsertCache Stats</STRONG>*:</P> Tue, 29 Sep 2020 14:35:20 GMT brent_weaver 2020-09-29T14:35:20Z https://community.splunk.com/t5/Knowledge-Management/Get-event-into-kvpairs/m-p/364055#M5199 <P>I have this event:</P> <PRE><CODE>2017-06-26|20:37:56.551 [Thread-26] INFO [InsertCache.java:56] - InsertCache Stats: getTagCacheHits() = 191891 getTagCacheMisses() = 14 getBucketCacheHits() = 191879 getBucketCacheMisses() = 26 getIntervalCacheHits() = 186294 getIntervalCacheMisses() = 5611 getVersionCacheHits() = 186294 getVersionCacheMisses() = 5611 getTotalCacheHits() = 756358 getTotalCacheMisses() = 11262 getTotalEvictionCount() = 10095 </CODE></PRE> <P>How would I get the KEY() = VALUE into nvpairs in splunk after*<STRONG>InsertCache Stats</STRONG>*:</P> Tue, 29 Sep 2020 14:35:20 GMT https://community.splunk.com/t5/Knowledge-Management/Get-event-into-kvpairs/m-p/364055#M5199 brent_weaver 2020-09-29T14:35:20Z https://community.splunk.com/t5/Knowledge-Management/Get-event-into-kvpairs/m-p/364056#M5200 <P>Using inline in the search, you can do like this</P> <PRE><CODE>your base search | rex mode=sed "s/(\w+)\(\)\s*\=\s*(\S+)/\1=\2/g" | extract </CODE></PRE> Mon, 26 Jun 2017 20:51:25 GMT https://community.splunk.com/t5/Knowledge-Management/Get-event-into-kvpairs/m-p/364056#M5200 somesoni2 2017-06-26T20:51:25Z