topic SPL to extract field and field value? in Splunk Search

SPL to extract field and field value?

AK_Splunk — Mon, 31 Oct 2022 09:16:25 GMT

SPL to extract field and field value when data seems like below

screenshot attached.
I need help in extracting field as memUsedPct which should hold the value as 82,3.

Re: SPL to extract field and field value

yuanliu — Mon, 31 Oct 2022 09:07:58 GMT

Using screenshots to illustrate complex data is a terrible method. Try using text.

This said, are you suggesting that you have input with CSV format? One way to handle them is to use multikv. Assuming that data is already in _raw:

| multikv forceheader=1

If it is that in _raw, but in a field called CSV_data, swap it with _raw,

| rename _raw as temp, CSV_data as _raw | multikv forceheader=1 | rename temp as _raw ``` assume that you no longer care about CSV_data ```

Re: SPL to extract field and field value?

AK_Splunk — Mon, 31 Oct 2022 10:46:49 GMT

Thanks for your quick response.

| multikv forceheader=1

The multikv command isnt helping much.Currently I am getting balnk in the memUsedPct.

I need to extract only memUsedPct as 17,7.

Re: SPL to extract field and field value?

yuanliu — Tue, 01 Nov 2022 04:17:40 GMT

You need to demonstrate your data, in text form. (Anonymize as needed, but maintain format.) How does a _raw event look like?