topic make extract command overwrite fields in Splunk Search

make extract command overwrite fields

kkalmbach — Mon, 28 Sep 2020 09:49:51 GMT

I have a field that looks like this:
key1=value1*key2=value2*key3=value3

I put in a stanza in transforms that looks like this:
[star_equals] SOURCE_KEY=my_field DELIMS="*" "="

Then I run a search like this:

index=something | extract star_equals

That works great for everything except the first key/value pair.

When splunk first does it's auto extract, it thinks
key1 has a value of value1*key2=value2*...

When I run the extract command, the value for key1 does not get overwritten.

I can't turn off splunk auto extractions (too much other stuff would break).

If I put in a "field - key1" before the extract, eveything works great, but I won't know what the first key will be, so that's not an option.

Any other ideas?

Re: make extract command overwrite fields

fk319 — Mon, 29 Aug 2011 13:37:26 GMT

Can you include the character that is before the first field in DELIMS?

or if this is a sub part of the log, can you extract all the fields as one field, then process that field in a seperate regex?

Re: make extract command overwrite fields

kkalmbach — Mon, 29 Aug 2011 18:43:26 GMT

Thanks for the idea,
I'm not really following what you meant in the second part (this field is a subpart of the entire event). I do have this part extracted into a field. Are you talking about a new section in the transforms.prop file?

Re: make extract command overwrite fields

fk319 — Mon, 28 Sep 2020 09:50:59 GMT

if you have something like this:
Aug 30 12:34:54 "key1=value1*key2=value2*key3=value3"
then you can extract the keys as a single field.
From this field, you can then extract your keys.