Knowledge Management

Complex kv extraction

mfscully
Explorer

I have a log which has the following format:
$DateTime|$ServerName|caller_file_name|$caller_file_name|caller_package|$caller_package|...

The DateTime and ServerName values are always there, but the kv pairs afterwards are variable.
I tried using the extract command but it sets $DateTime=$ServerName.
What's the best way to extract the kv pairs?

Tags (3)
0 Karma
1 Solution

lguinn2
Legend

Well, you could do this in props.conf

[yoursourcetypename]
EXTRACT-e1=caller_file_name\|(?<caller_file_name>.*?)\|
EXTRACT-e1=caller_package\|(?<caller_package>.*?)\|

etc.

It isn't pretty but it is exact. If you try to extract using the REPORT option, with DELIMs, etc. - it won't work because Splunk expects name-value pairs. And your data doesn't start with a name-value pair. But you've already figured that out...

View solution in original post

0 Karma

lguinn2
Legend

Well, you could do this in props.conf

[yoursourcetypename]
EXTRACT-e1=caller_file_name\|(?<caller_file_name>.*?)\|
EXTRACT-e1=caller_package\|(?<caller_package>.*?)\|

etc.

It isn't pretty but it is exact. If you try to extract using the REPORT option, with DELIMs, etc. - it won't work because Splunk expects name-value pairs. And your data doesn't start with a name-value pair. But you've already figured that out...

View solution in original post

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!