topic Re: How to extract key value pairs in Knowledge Management

How to extract key value pairs

ts00011 — Thu, 11 Apr 2019 03:40:50 GMT

input: {author=John, book=Splunk }

output table

author book
John Splunk

Re: How to extract key value pairs

martin_mueller — Thu, 11 Apr 2019 10:33:00 GMT

Does automatic key=value extraction not work?

Re: How to extract key value pairs

dmarling — Thu, 11 Apr 2019 13:00:38 GMT

This will extract that information from _raw for any comma seperated key value pairing, which Splunk will do normally without much prompting, but this format is an odd format since it's wrapped in curly brackets like json, but contains a comma seperated key value pair instead of what I would expect from a json string.

| makeresults count=1
| eval _raw="{author=John, book=Splunk }"
| extract kvdelim="=" pairdelim=","

If your goal is to not have the curly bracket get picked up you can just remove it prior to the extract with this:

| makeresults count=1
| eval _raw="{author=John, book=Splunk }"
| rex field=_raw mode=sed "s/[\{\}]+//g"
| eval _raw=trim(_raw)
| extract kvdelim="=" pairdelim=","

Re: How to extract key value pairs

niketn — Thu, 11 Apr 2019 13:55:11 GMT

@ts00011 while posting code/data on Splunk Answers make sure to use the code button 101010 or shortcut Ctrl+K. This will ensure that special characters will not get escaped. If you have a valid JSON data, you should be able to use either one of KV_MODE=json or INDEXED_EXTRACTIONS=json turned on for Splunk to do either Search Time Field Extraction or Index Time Field Extraction (but not both, which will create duplicate result at search time), depending on your use case.

For your example a valid JSON should look like the following (notice colon : and double quotes "😞

{"author":"John","book":"Splunk"}

Following is a run anywhere example to show the output of how JSON data field extraction will look like.

| makeresults
| eval jsonData="{\"author\":\"John\",\"book\":\"Splunk\"}"
| rename jsonData as _raw
| spath

If your data is indeed not valid json and is of the same form as your example, you should still be able to define field extractions (search time) to extract them.

Re: How to extract key value pairs

jotne — Fri, 07 Mar 2025 10:05:42 GMT

No need for the renaming to _raw

| makeresults | eval jsonData="{\"author\":\"John\",\"book\":\"Splunk\"}" | spath input=jsonData