topic Re: Extract field value in Splunk Search

Extract field value

vintik — Thu, 03 May 2018 09:47:40 GMT

Hello,

Could anybody assist with this question - what method is the best to extract to new field value of "animal" key? Should I use eval or searchmatch or something else?

Here is example:

[some_date] ..."application":"some_app", "animal":"dog","segment":....
[some_date] ..."application":"some_app", "animal":"cat","segment":....

I need this variable to use in stats.

Re: Extract field value

FrankVl — Thu, 03 May 2018 09:58:27 GMT

This should work:
| rex "\"animal\":\"(?<animal>[^\"]+)\""

Alternatively, you could try the following to apply key value extractions on your events. Whether this works properly depends on what exactly your full data looks like, but might be worth playing around with.
| extract pairdelim=",", kvdelim=":"

Re: Extract field value

althomas — Thu, 03 May 2018 10:01:04 GMT

If it's json, use spath

Otherwise you can do something like this:

transforms.conf:

[my_kv_transform]
FORMAT = $1::$2
REGEX = \"([^"]+)\":\"([^"]+)\"

props.conf

[my_sourcetype]
REPORT-my_sourcetype_kv = my_kv_transform

This should do search-time extractions to get animal=dog and application=someapp