topic Basic Key Value extraction in Splunk Search

Basic Key Value extraction

erichard — Sun, 22 Apr 2018 09:13:23 GMT

Hello,

I receive message like this :

 topic="Sniffer" message=""timestamp"="1524387631351","process"="com.x.android.apps","packageName"="com.google.android.gms","type"="URL","URL"="https://x.x.com/UploadConfigurationService/UnitUploadSettings/x071x?clientId=xx-mobile""
topic="Sniffer" message=""timestamp"="1524387779884","process"="com.google.android.gms","packageName"="com.google.android.gms","type"="URL","URL"="https://android.clients.google.com/c2dm/register3""

and I need to extract all key/value from "message=" without knowing the fields, I have only the syntaxe KV so here I would like to have :

process : com.x.android.apps
packageName : com.google.android.gms
...

I try without sucess :

index=devices Sniffer  |  rex field=_raw ".*message=\"(?<message>.*)\"" |   extract pairdelim="," kvdelim="=" |table  *

Any idea ?

Thanks for your help 😉

Re: Basic Key Value extraction

niketn — Sun, 22 Apr 2018 12:22:25 GMT

@erichard, try the following run anywhere search based on sample data provided. (Commands from | makeresults to | rename data as _raw generate dummy data. Assuming you have two events starting from topic field)

| makeresults
| eval data="topic=\"Sniffer\" message=\"\"timestamp\"=\"1524387631351\",\"process\"=\"com.x.android.apps\",\"packageName\"=\"com.google.android.gms\",\"type\"=\"URL\",\"URL\"=\"https://x.x.com/UploadConfigurationService/UnitUploadSettings/x071x?clientId=xx-mobile\"\"; topic=\"Sniffer\" message=\"\"timestamp\"=\"1524387779884\",\"process\"=\"com.google.android.gms\",\"packageName\"=\"com.google.android.gms\",\"type\"=\"URL\",\"URL\"=\"https://android.clients.google.com/c2dm/register3\"\""
| makemv data delim=";"
| mvexpand data
| rename data as _raw
| rex ".*message=\"(?<message>.*)\"" 
| rename message as _raw
| extract pairdelim="," kvdelim="="
| table *

Re: Basic Key Value extraction

erichard — Sun, 22 Apr 2018 13:29:21 GMT

@niketnilay Many thanks !!!