topic Split complex event to key value table in Splunk Search https://community.splunk.com/t5/Splunk-Search/Split-complex-event-to-key-value-table/m-p/522941#M147470 <P>Hi,</P><P>I'm trying to split this event into a</P><TABLE border="1" width="100%"><TBODY><TR><TD width="50%">name</TD><TD width="50%">value</TD></TR><TR><TD width="50%">FieldA</TD><TD width="50%">false</TD></TR><TR><TD width="50%">FieldB</TD><TD width="50%">5</TD></TR></TBODY></TABLE><P>key-value table</P><P>&nbsp;</P><LI-CODE lang="markup">org.Data@28c839cfname=FieldA, value=false, org.Data@49b45b79name=FealedB, value=5,</LI-CODE><P>&nbsp;</P><P>Query:&nbsp;</P><P>1. base_query |&nbsp;&nbsp;extract pairdelim="&nbsp; ", kvdelim=" " | table _raw<BR />2.&nbsp;base_query |&nbsp;&nbsp;extract pairdelim="org.data*=", kvdelim=" " | table _raw</P><P>is it possible?<BR /><BR />Thanks</P> Mon, 05 Oct 2020 09:32:30 GMT ormoush 2020-10-05T09:32:30Z Split complex event to key value table https://community.splunk.com/t5/Splunk-Search/Split-complex-event-to-key-value-table/m-p/522941#M147470 <P>Hi,</P><P>I'm trying to split this event into a</P><TABLE border="1" width="100%"><TBODY><TR><TD width="50%">name</TD><TD width="50%">value</TD></TR><TR><TD width="50%">FieldA</TD><TD width="50%">false</TD></TR><TR><TD width="50%">FieldB</TD><TD width="50%">5</TD></TR></TBODY></TABLE><P>key-value table</P><P>&nbsp;</P><LI-CODE lang="markup">org.Data@28c839cfname=FieldA, value=false, org.Data@49b45b79name=FealedB, value=5,</LI-CODE><P>&nbsp;</P><P>Query:&nbsp;</P><P>1. base_query |&nbsp;&nbsp;extract pairdelim="&nbsp; ", kvdelim=" " | table _raw<BR />2.&nbsp;base_query |&nbsp;&nbsp;extract pairdelim="org.data*=", kvdelim=" " | table _raw</P><P>is it possible?<BR /><BR />Thanks</P> Mon, 05 Oct 2020 09:32:30 GMT https://community.splunk.com/t5/Splunk-Search/Split-complex-event-to-key-value-table/m-p/522941#M147470 ormoush 2020-10-05T09:32:30Z Re: Split complex event to key value table https://community.splunk.com/t5/Splunk-Search/Split-complex-event-to-key-value-table/m-p/522944#M147471 <LI-CODE lang="markup">| rex max_match=0 "org.Data[^=]+=(?&lt;name&gt;[^,]+),\svalue=(?&lt;value&gt;[^,]+)" | eval fieldvalue=mvzip(name, value) | fields fieldvalue | mvexpand fieldvalue | rex field=fieldvalue "(?&lt;name&gt;[^,]+),(?&lt;value&gt;.+)" | table name, value</LI-CODE> Mon, 05 Oct 2020 09:56:54 GMT https://community.splunk.com/t5/Splunk-Search/Split-complex-event-to-key-value-table/m-p/522944#M147471 ITWhisperer 2020-10-05T09:56:54Z