https://community.splunk.com/t5/Knowledge-Management/Complex-kv-extraction/m-p/160890#M7640 <P>Well, you could do this in props.conf</P> <PRE><CODE>[yoursourcetypename] EXTRACT-e1=caller_file_name\|(?&lt;caller_file_name&gt;.*?)\| EXTRACT-e1=caller_package\|(?&lt;caller_package&gt;.*?)\| </CODE></PRE> <P>etc.</P> <P>It isn't pretty but it is exact. If you try to extract using the REPORT option, with DELIMs, etc. - it won't work because Splunk expects name-value pairs. And your data doesn't start with a name-value pair. But you've already figured that out...</P> Wed, 17 Dec 2014 22:50:07 GMT lguinn2 2014-12-17T22:50:07Z https://community.splunk.com/t5/Knowledge-Management/Complex-kv-extraction/m-p/160889#M7639 <P>I have a log which has the following format:<BR /> $DateTime|$ServerName|caller_file_name|$caller_file_name|caller_package|$caller_package|...</P> <P>The DateTime and ServerName values are always there, but the kv pairs afterwards are variable.<BR /> I tried using the extract command but it sets $DateTime=$ServerName.<BR /> What's the best way to extract the kv pairs?</P> Mon, 28 Sep 2020 18:28:15 GMT https://community.splunk.com/t5/Knowledge-Management/Complex-kv-extraction/m-p/160889#M7639 mfscully 2020-09-28T18:28:15Z https://community.splunk.com/t5/Knowledge-Management/Complex-kv-extraction/m-p/160890#M7640 <P>Well, you could do this in props.conf</P> <PRE><CODE>[yoursourcetypename] EXTRACT-e1=caller_file_name\|(?&lt;caller_file_name&gt;.*?)\| EXTRACT-e1=caller_package\|(?&lt;caller_package&gt;.*?)\| </CODE></PRE> <P>etc.</P> <P>It isn't pretty but it is exact. If you try to extract using the REPORT option, with DELIMs, etc. - it won't work because Splunk expects name-value pairs. And your data doesn't start with a name-value pair. But you've already figured that out...</P> Wed, 17 Dec 2014 22:50:07 GMT https://community.splunk.com/t5/Knowledge-Management/Complex-kv-extraction/m-p/160890#M7640 lguinn2 2014-12-17T22:50:07Z