I've a log in which instead of X=Y, it is present as "X":"Y". How do I extract X as a field and Y as its value?

[sagar1905]

I've a log in which instead of X=Y, it is present as "X":"Y". How do I extract X as a field and Y as its value?

[shaskell_splunk]

Have a look at the extract command:

http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Extract

| makeresults | eval _raw="X:Y, key1:value1, key2:value2" | extract pairdelim="," kvdelim=":"

[somesoni2]

Assuming your key value pairs are colon separated, instead of equal sign = separated, to do this automatically, setup this in your search heads,

props.conf

[yourSourceTYpe]
REPORT-extractFields = colon_separated_fields

transforms.conf

[colon_separated_fields]
REGEX = \"([^\"]+)\"\s*\:\s*\"([^\"]+)\"
FORMAT = $1::$2

A search head restart would be required (depends upon which method you use to deploy this to SH).

[sagar1905]

Hi,

I actually dont have access to the splunk servers, I'm using the splunk enterprise app in my company. A part of a log is how I defined in my question, how can i extract them?

Thanks

[somesoni2]

So you want to extract them at search time? If yes, then try like this

your current search 
| extract pairdelim=", " , kvdelim=":"

More accurate answer can be suggested if you can paste an actual sample log entry (mask any sensitive info).