topic Re: What is the best way to extract data when my log has with comma separated fields and the field-value pairs are separated by a colon? in Splunk Search https://community.splunk.com/t5/Splunk-Search/What-is-the-best-way-to-extract-data-when-my-log-has-with-comma/m-p/282792#M85420 <P>Have you had a look at DELIMS in transforms.conf? Here is something that should work;</P> <P>[comma_colon]<BR /> DELIMS = ",", ":"</P> Wed, 08 Feb 2017 21:40:16 GMT karlbosanquet 2017-02-08T21:40:16Z What is the best way to extract data when my log has with comma separated fields and the field-value pairs are separated by a colon? https://community.splunk.com/t5/Splunk-Search/What-is-the-best-way-to-extract-data-when-my-log-has-with-comma/m-p/282791#M85419 <P>How would I go about parsing out/extracting the field data for the following log format?</P> <P>"fieldname1":"fieldvalue1","timestamp":"2017-02-07 14:19:54.166","ip_address":"3.3.3.3","user_id":"USER1"<BR /> "fieldname1":"fieldvalue1","timestamp":"2017-02-07 14:19:52.395","fieldname2":"fieldvalue2","user_id":"USER2"<BR /> "fieldname1":"fieldvalue1","timestamp":"2017-02-07 14:19:50.316","ip_address":"8.8.8.8","fieldname2":"fieldvalue2"</P> <P>Not all lines of logs will contain all the same fields, but field names are constant. The fields are always comma separated and then in "field":"value" pairs. Currently, I have separate field extractions for each interesting field such as:</P> <P>\"fieldname1\":\"(?P[a-zA-z]*)</P> <P>Is this the right way to do this or is there an easier or more proper method?</P> Tue, 29 Sep 2020 12:45:49 GMT https://community.splunk.com/t5/Splunk-Search/What-is-the-best-way-to-extract-data-when-my-log-has-with-comma/m-p/282791#M85419 nunyabizness123 2020-09-29T12:45:49Z Re: What is the best way to extract data when my log has with comma separated fields and the field-value pairs are separated by a colon? https://community.splunk.com/t5/Splunk-Search/What-is-the-best-way-to-extract-data-when-my-log-has-with-comma/m-p/282792#M85420 <P>Have you had a look at DELIMS in transforms.conf? Here is something that should work;</P> <P>[comma_colon]<BR /> DELIMS = ",", ":"</P> Wed, 08 Feb 2017 21:40:16 GMT https://community.splunk.com/t5/Splunk-Search/What-is-the-best-way-to-extract-data-when-my-log-has-with-comma/m-p/282792#M85420 karlbosanquet 2017-02-08T21:40:16Z Re: What is the best way to extract data when my log has with comma separated fields and the field-value pairs are separated by a colon? https://community.splunk.com/t5/Splunk-Search/What-is-the-best-way-to-extract-data-when-my-log-has-with-comma/m-p/282793#M85421 <P>@nunyabizness123 - Did the answer provided by karlbosanquet help provide a working solution to your question? If yes, please don't forget to resolve this post by clicking "Accept". If no, please leave a comment with more feedback. Thanks!</P> Sat, 11 Mar 2017 18:44:34 GMT https://community.splunk.com/t5/Splunk-Search/What-is-the-best-way-to-extract-data-when-my-log-has-with-comma/m-p/282793#M85421 aaraneta_splunk 2017-03-11T18:44:34Z