https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-fields-for-kv-pair-syslog-data/m-p/431457#M123329 <P>Hi @knalla, </P> <P>this regular expression should work </P> <P><CODE>^(?:[^\s]+\s*:){5}|([^:]+):\s*([^,]+)[,$]*</CODE><BR /> <A href="https://regex101.com/r/0lWcR3/1">https://regex101.com/r/0lWcR3/1</A></P> <PRE><CODE>props.conf [yoursourcetype] TRANSFORMS-yourfirstextraction = extractexample transforms.conf [extractexample] REGEX=^(?:[^\s]+\s*:){5}|([^:]+):\s*([^,]+)[,$]* FORMAT = $1::$2 MV_ADD = true </CODE></PRE> Mon, 27 Aug 2018 15:25:20 GMT horsefez 2018-08-27T15:25:20Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-fields-for-kv-pair-syslog-data/m-p/431456#M123328 <P>Hi All,</P> <P>How to extract the fields for the syslog data with kv values at indexing time?</P> <P><CODE>Aug 27 10:05:58 ciscoasa SFIMS: Protocol: TCP, SrcIP: 1.2.3.1, OriginalClientIP: ::, DstIP: 11.22.33.44, SrcPort: 50981, DstPort: 443, TCPFlags: 0x0, IngressZone: N_inside, EgressZone: N_outside, DE: Primary Detection Engine (ccc24074-6d7e-11e7-9213-b429232f86cc), Policy:allowed_new, ConnectType: Start, AccessControlRuleName: Allow port 80 443, AccessControlRuleAction: Allow, Prefilter Policy: WE_Prefilter, UserName: No Authentication Required, Client: SSL client, ApplicationProtocol: HTTPS, WebApplication: Windows, InitiatorPackets: 3, ResponderPackets: 1, InitiatorBytes: 436, ResponderBytes: 66, Policy: Balanced Security and Connectivity, DNSResponseType: No Error, Sinkhole: Unknown, URLCategory: Business and Economy, URLReputation: Well known, URL: splunk.com</CODE></P> Mon, 27 Aug 2018 15:13:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-fields-for-kv-pair-syslog-data/m-p/431456#M123328 knalla 2018-08-27T15:13:32Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-fields-for-kv-pair-syslog-data/m-p/431457#M123329 <P>Hi @knalla, </P> <P>this regular expression should work </P> <P><CODE>^(?:[^\s]+\s*:){5}|([^:]+):\s*([^,]+)[,$]*</CODE><BR /> <A href="https://regex101.com/r/0lWcR3/1">https://regex101.com/r/0lWcR3/1</A></P> <PRE><CODE>props.conf [yoursourcetype] TRANSFORMS-yourfirstextraction = extractexample transforms.conf [extractexample] REGEX=^(?:[^\s]+\s*:){5}|([^:]+):\s*([^,]+)[,$]* FORMAT = $1::$2 MV_ADD = true </CODE></PRE> Mon, 27 Aug 2018 15:25:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-fields-for-kv-pair-syslog-data/m-p/431457#M123329 horsefez 2018-08-27T15:25:20Z