https://community.splunk.com/t5/Splunk-Search/How-to-extract-key-value-pair-from-string/m-p/586343#M204263 <P>No its not working</P> Thu, 24 Feb 2022 03:34:07 GMT Mofizul 2022-02-24T03:34:07Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-key-value-pair-from-string/m-p/586251#M204218 <P>Have a search result as</P> <P>GET https://…. | Status: 403 | Message: Forbidden | Duration: 166 | x-req-id: ssv5s-ssy67-78vshb | x-correlation-id: vsvsuj-75sys7-sbbjs7</P> <P>&nbsp;</P> <P>Need to extract value of x-req-id .</P> <P>&nbsp;</P> <P>Tried this extract pairdelim="|" , kvdelim=":" ,which gives Status &amp; Message &amp; Duration but not able to fetch&nbsp; x-req-id</P> Wed, 23 Feb 2022 17:45:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-key-value-pair-from-string/m-p/586251#M204218 Mofizul 2022-02-23T17:45:31Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-key-value-pair-from-string/m-p/586262#M204227 <P>This works for me - which version of splunk are you using?</P><LI-CODE lang="markup">| makeresults | eval _raw="GET https://…. | Status: 403 | Message: Forbidden | Duration: 166 | x-req-id: ssv5s-ssy67-78vshb | x-correlation-id: vsvsuj-75sys7-sbbjs7" | extract pairdelim="|" kvdelim=":"</LI-CODE> Wed, 23 Feb 2022 15:38:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-key-value-pair-from-string/m-p/586262#M204227 ITWhisperer 2022-02-23T15:38:09Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-key-value-pair-from-string/m-p/586271#M204233 <P>Splunk 8.2.2.1</P> Wed, 23 Feb 2022 16:09:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-key-value-pair-from-string/m-p/586271#M204233 Mofizul 2022-02-23T16:09:26Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-key-value-pair-from-string/m-p/586278#M204236 <P>Same here - so does my run anywhere example work for you?</P> Wed, 23 Feb 2022 16:25:38 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-key-value-pair-from-string/m-p/586278#M204236 ITWhisperer 2022-02-23T16:25:38Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-key-value-pair-from-string/m-p/586343#M204263 <P>No its not working</P> Thu, 24 Feb 2022 03:34:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-key-value-pair-from-string/m-p/586343#M204263 Mofizul 2022-02-24T03:34:07Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-key-value-pair-from-string/m-p/586402#M204277 <P>Do you get any errors reported which might help determine what the issue might be other than "its not working"?</P> Thu, 24 Feb 2022 12:07:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-key-value-pair-from-string/m-p/586402#M204277 ITWhisperer 2022-02-24T12:07:27Z