topic How to auto dynamically extract all keyN to fields? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-auto-dynamically-extract-all-keyN-to-fields/m-p/612640#M212998 <P>Hi,</P> <P>I have a log that will dynamically add "fields" to log record based on some logic.</P> <P>It's syslog begging + payload that looks like (example)</P> <P>Sep 10 16:52:07 11.11.11.11 Sep 10 16:52:07 process[111]: app=test&amp;key0=value0&amp;key1=value1&amp;key2=key...&amp;keyN=valueN</P> <P>how to automatically/dynamically extract all keyN to fields.</P> Mon, 12 Sep 2022 02:58:26 GMT jbanAtSplunk 2022-09-12T02:58:26Z How to auto dynamically extract all keyN to fields? https://community.splunk.com/t5/Splunk-Search/How-to-auto-dynamically-extract-all-keyN-to-fields/m-p/612640#M212998 <P>Hi,</P> <P>I have a log that will dynamically add "fields" to log record based on some logic.</P> <P>It's syslog begging + payload that looks like (example)</P> <P>Sep 10 16:52:07 11.11.11.11 Sep 10 16:52:07 process[111]: app=test&amp;key0=value0&amp;key1=value1&amp;key2=key...&amp;keyN=valueN</P> <P>how to automatically/dynamically extract all keyN to fields.</P> Mon, 12 Sep 2022 02:58:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-auto-dynamically-extract-all-keyN-to-fields/m-p/612640#M212998 jbanAtSplunk 2022-09-12T02:58:26Z Re: auto dynamic field extract https://community.splunk.com/t5/Splunk-Search/How-to-auto-dynamically-extract-all-keyN-to-fields/m-p/612643#M213001 <P>How is the props.conf section for this sourcetype? (Also see&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf#Field_extraction_configuration" target="_blank" rel="noopener">Field extraction configuration</A>&nbsp;especially KV_MODE.) &nbsp;It is rather strange that Splunk doesn't already extract all pairs separated by =.</P> Sat, 10 Sep 2022 20:07:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-auto-dynamically-extract-all-keyN-to-fields/m-p/612643#M213001 yuanliu 2022-09-10T20:07:18Z Re: auto dynamic field extract https://community.splunk.com/t5/Splunk-Search/How-to-auto-dynamically-extract-all-keyN-to-fields/m-p/612652#M213004 <P>checked under the hood, looks like there is sourcetype transformations so that stanza didn't have KV_MODE.<BR />I put KV_MODE=auto_escaped and it'll extract it automatically.</P> Sun, 11 Sep 2022 11:14:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-auto-dynamically-extract-all-keyN-to-fields/m-p/612652#M213004 jbanAtSplunk 2022-09-11T11:14:50Z