Getting Data In

Help extracting key value pairs within a grouped/nested field.

timgren
Explorer

I'm trying to pull KV pairs from a event field, and having trouble. The issue is I don't know what the field names will be, nor how many. The parent field value also groups the KV pairs within braces, adding and additional layer of brain trauma. 

In testing,  /([^{=,]+)=([^,}]+)/g  does the job in regex101, but not splunk. 

Such as:

| makeresults

| eval msg.additionalValues="{field1=value1, field2=value2, field3=value3}"

| rex field=msg.additionalValues "/([^{=,]+)=([^,}]+)/g" 

Results in: 

Error: "Error in 'rex' command: The regex '/([^{=,]+)=([^,}]+)/g' does not extract anything. It should specify at least one named group. Format: (?<name>...)." 

Since i have multiple named groups, how is this possible? 

 

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults
| eval msg.additionalValues="{field1=value1, field2=value2, field3=value3}"
| rex field=msg.additionalValues "(?<fields>[^{}]+)"
| rename fields as _raw
| extract pairdelim="," kvdelim="="

timgren
Explorer

Excellent!  Can this solution be applied to an auto-extraction or transformation method? 

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!