topic Re: extract command in Splunk Search

extract command

splunkn — Mon, 18 Jul 2016 10:45:43 GMT

Hi,

This is sample event. I tried to explore extract command.

index=* sourcetype=orange | extract pairdelim=";", kvdelim=":"

4/18/161:00:00.000 PM 2016-04-18 13:00:00 user:hgfh;std:6;status:success

For the above event its only extracted std as 6 and status as success but not the user. Why is that like. So is it expecting ";" before and after?

And cant we use kvdelim alone in our queries?
index=* sourcetype=orange | extract kvdelim=":"

Thanks

Re: extract command

tormodbp — Mon, 18 Jul 2016 14:10:50 GMT

Try specifying space-character as a pair delimiter as well.

index=* sourcetype=orange | extract pairdelim="; " kvdelim=":"

For me that gave the correct and expected result.

user:hgfh
std:6
status:success

I suspect that since the kv extract is "mid-sentence" it tries to outrule anything that does not fit exactly with the specified pair delimiter. Thus resulting in the return of only two kv-pairs unless you specify space and semicolon as pair delimiters.

Cheers,

Re: extract command

splunkn — Tue, 19 Jul 2016 06:34:26 GMT

Thanks tomodbp. Its worked !! aren't we able to use kvdelim alone?

Re: extract command

tormodbp — Tue, 19 Jul 2016 07:04:00 GMT

No problem!
I would think that you should be able to, but I am unable to find any documentation to support that claim. I've tried to experiment with the parameters. So far I have not found any other solution using ´kv´ / ´extract´, sorry.