https://community.splunk.com/t5/Splunk-Search/How-to-use-extract-kvdelim-and-pairdelim-to-parse-all-key-value/m-p/263747#M79159 <P>We have log entries similar to below and while I can write a regex expression to parse out all the kv pairs separated by a :, I wanted to know if there was a way I could use extract kvdelim to do the same. Note that all the k:v pairs come AFTER the % expression. In this case they also come after the = sign (Some logs do not have the = sign)</P> <PRE><CODE>Jan 5 18:21:49.817: %VOIPAAA-5-VOIP_FEAT_HISTORY: FEAT_VSA=fn:TWC,ft:01/05/2012 18:21:34.254,cgn:3333,cdn:1023,frs:0,fid:1013,fcid:EDD6080E370011E18A2BC77F1C86C06D,legID:455,bguid:EDD6080E370011E18A2BC77F1C86C06D </CODE></PRE> <P>I'm trying to do it via the search first before putting it into the transforms.conf so my search currently is </P> <PRE><CODE>FEAT_HISTORY | extract pairdelim="=%",kvdelim=":" </CODE></PRE> <P>but that doesn't work, it doesn't extract the k:v pairs in the above. Is there a way I can get the above to work or should I just stick with the long regex expression I've created?</P> <P>Thanks</P> <P>ref 1: <A href="http://docs.splunk.com/Documentation/Splunk/6.1.4/SearchReference/Extract">http://docs.splunk.com/Documentation/Splunk/6.1.4/SearchReference/Extract</A><BR /> ref 2: <A href="http://blogs.splunk.com/2008/02/12/delimiter-based-key-value-pair-extraction/">http://blogs.splunk.com/2008/02/12/delimiter-based-key-value-pair-extraction/</A></P> Tue, 29 Mar 2016 18:54:00 GMT reswob4 2016-03-29T18:54:00Z https://community.splunk.com/t5/Splunk-Search/How-to-use-extract-kvdelim-and-pairdelim-to-parse-all-key-value/m-p/263747#M79159 <P>We have log entries similar to below and while I can write a regex expression to parse out all the kv pairs separated by a :, I wanted to know if there was a way I could use extract kvdelim to do the same. Note that all the k:v pairs come AFTER the % expression. In this case they also come after the = sign (Some logs do not have the = sign)</P> <PRE><CODE>Jan 5 18:21:49.817: %VOIPAAA-5-VOIP_FEAT_HISTORY: FEAT_VSA=fn:TWC,ft:01/05/2012 18:21:34.254,cgn:3333,cdn:1023,frs:0,fid:1013,fcid:EDD6080E370011E18A2BC77F1C86C06D,legID:455,bguid:EDD6080E370011E18A2BC77F1C86C06D </CODE></PRE> <P>I'm trying to do it via the search first before putting it into the transforms.conf so my search currently is </P> <PRE><CODE>FEAT_HISTORY | extract pairdelim="=%",kvdelim=":" </CODE></PRE> <P>but that doesn't work, it doesn't extract the k:v pairs in the above. Is there a way I can get the above to work or should I just stick with the long regex expression I've created?</P> <P>Thanks</P> <P>ref 1: <A href="http://docs.splunk.com/Documentation/Splunk/6.1.4/SearchReference/Extract">http://docs.splunk.com/Documentation/Splunk/6.1.4/SearchReference/Extract</A><BR /> ref 2: <A href="http://blogs.splunk.com/2008/02/12/delimiter-based-key-value-pair-extraction/">http://blogs.splunk.com/2008/02/12/delimiter-based-key-value-pair-extraction/</A></P> Tue, 29 Mar 2016 18:54:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-extract-kvdelim-and-pairdelim-to-parse-all-key-value/m-p/263747#M79159 reswob4 2016-03-29T18:54:00Z https://community.splunk.com/t5/Splunk-Search/How-to-use-extract-kvdelim-and-pairdelim-to-parse-all-key-value/m-p/263748#M79160 <P>Hi, try this and let me know if helps:</P> <PRE><CODE>| stats count | eval _raw = "Jan 5 18:21:49.817: %VOIPAAA-5-VOIP_FEAT_HISTORY: FEAT_VSA=fn:TWC,ft:01/05/2012 18:21:34.254,cgn:3333,cdn:1023,frs:0,fid:1013,fcid:EDD6080E370011E18A2BC77F1C86C06D,legID:455,bguid:EDD6080E370011E18A2BC77F1C86C06D" | extract kvdelim=":" pairdelim="," </CODE></PRE> <P>This is the output I'm getting:</P> <PRE><CODE>FEAT_VSA fn:TWC bguid EDD6080E370011E18A2BC77F1C86C06D cdn 1023 cgn 3333 fcid EDD6080E370011E18A2BC77F1C86C06D fid 1013 frs 0 legID 455 </CODE></PRE> Tue, 29 Mar 2016 19:01:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-extract-kvdelim-and-pairdelim-to-parse-all-key-value/m-p/263748#M79160 javiergn 2016-03-29T19:01:41Z https://community.splunk.com/t5/Splunk-Search/How-to-use-extract-kvdelim-and-pairdelim-to-parse-all-key-value/m-p/263749#M79161 <P>A: That was fast<BR /> B: That worked</P> <P>Thanks</P> Tue, 29 Mar 2016 19:07:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-extract-kvdelim-and-pairdelim-to-parse-all-key-value/m-p/263749#M79161 reswob4 2016-03-29T19:07:45Z https://community.splunk.com/t5/Splunk-Search/How-to-use-extract-kvdelim-and-pairdelim-to-parse-all-key-value/m-p/263750#M79162 <P>I take it back a little: It worked mostly. It did not extract ft, where the time is stored. probably because there are colons in the middle of that field. I can regex that though.</P> Tue, 29 Mar 2016 19:10:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-extract-kvdelim-and-pairdelim-to-parse-all-key-value/m-p/263750#M79162 reswob4 2016-03-29T19:10:07Z