Extracting one field into multiple fields

BearMormont — Mon, 19 Mar 2018 13:32:01 GMT

I have some data that looks similar to the following:

{
  Name: Record1
  Tags: [
    {
      Key: Tag1
      Value: Value1
    }
    {
      Key: Tag2
      Value: Value2
    }
    {
      Key: Tag3
      Value: Value3
    }    
  ]
}

I am trying to create output table that looks like the following:

Name     Tag1    Tag2    Tag3
-------------------------------
Record1  Value1  Value2  Value3

What have been trying to do so far is pathing into Tags and them combining them into one value, like so:

... | spath tags=Tags{} output=Tags | nomv Tags

This gives me one field with all the values that look like this:

 {Key:Tag1,Value:Value1}{Key:Tag2,Value:Value2}{Key:Tag3,Value:Value3}

I'm thinking what I need to do next is a foreach statement to extract those values into an eval field, but can't quite seem to get it. Keep in mind I don't know what the Tags will be actually named, what their value will be, or how many there are for any given record.

Any suggestions would be appreciated. Or if there is an easier way to accomplish this, I am open to anything. 🙂

Thanks!

Re: Extracting one field into multiple fields

kyaparla — Tue, 20 Mar 2018 23:14:26 GMT

Try using transforms and extract keys and values into different groups.

Enable multi value for the transforms

[keyvaluepairs] REGEX = \{\"key\"\:\"([^\"]+)\",\"value\"\:\"([^\"]+) FORMAT=$1::$2

and use above transforms like below in search

search | extract keyvaluepairs

topic Extracting one field into multiple fields in Splunk Search

Extracting one field into multiple fields

Re: Extracting one field into multiple fields