topic Re: Extract data from quotation marks in Splunk Search

How to extract data from quotation marks?

Lazous — Tue, 18 Apr 2023 18:07:17 GMT

Hello,
I am trying to extract the data from the following message:
the header data is in quotes and for each header data there is a set of secondary data also in quotes.
The events are presented as follows:

{Name=SS, PId=236}
PROD {Type=A_OUTGOING, Id=7934,plan=8975, Conflict=2529, Date=2023-04-18T18:51:00.000+02:00}
PROD {Type=B_OUTGOING, Id=7934, plan=8975, Conflict=72482, Date=2023-04-18T18:51:00.000+02:00}
{Name=DAG, PId=55}
PROD {Type=B_INCOMING, Id=7921, plan=8975, Conflict=64870, Date=2023-04-18T18:51:00.000+02:00}

The following result is expected:

Name	PId	Type	Id	plan	Conflict	Date
SS	236	A_OUTGOING	7934	8975	2529	2023-04-18T18:51:00.000+02:00
SS	236	B_OUTGOING	7934	8975	72482	2023-04-18T18:51:00.000+02:00
DAG	55	B_INCOMING	7921	8975	64870	2023-04-18T18:51:00.000+02:00

Would you please help? Thanking you

Re: Extract data from quotation marks

ITWhisperer — Tue, 18 Apr 2023 17:25:12 GMT

Given that this looks like it might be JSON, have you tried using spath?

Re: Extract data from quotation marks

woodcock — Tue, 18 Apr 2023 17:31:56 GMT

That data is JSON so the quick/easy/wrong fix is just to add this to your search:
| kv

But the better answer is to add this to your props.conf for your source/sourcetype:
KV_MODE = json

Re: Extract data from quotation marks

Lazous — Tue, 18 Apr 2023 18:31:13 GMT

i tried adding the | kv,

and i do not get all the data in the result set.

am not allowed to edit the props.conf

Re: Extract data from quotation marks

Lazous — Tue, 18 Apr 2023 18:32:16 GMT

would you please specify how the command would look like in this case ?

Re: Extract data from quotation marks

woodcock — Tue, 18 Apr 2023 18:43:26 GMT

| makeresults
| eval raw="{Name=SS, PId=236}
PROD {Type=A_OUTGOING, Id=7934,plan=8975, Conflict=2529, Date=2023-04-18T18:51:00.000+02:00}
PROD {Type=B_OUTGOING, Id=7934, plan=8975, Conflict=72482, Date=2023-04-18T18:51:00.000+02:00} {Name=DAG, PId=55}
PROD {Type=B_INCOMING, Id=7921, plan=8975, Conflict=64870, Date=2023-04-18T18:51:00.000+02:00}"
| makemv delim="
" raw
| mvexpand raw
| rename raw AS _raw
| kv