How to extract key value pairs

[ts00011]

input: {author=John, book=Splunk }

output table

author book
John Splunk

[niketn]

@ts00011 while posting code/data on Splunk Answers make sure to use the code button 101010 or shortcut Ctrl+K. This will ensure that special characters will not get escaped. If you have a valid JSON data, you should be able to use either one of KV_MODE=json or INDEXED_EXTRACTIONS=json turned on for Splunk to do either Search Time Field Extraction or Index Time Field Extraction (but not both, which will create duplicate result at search time), depending on your use case.

For your example a valid JSON should look like the following (notice colon : and double quotes "😞

{"author":"John","book":"Splunk"}

Following is a run anywhere example to show the output of how JSON data field extraction will look like.

| makeresults
| eval jsonData="{\"author\":\"John\",\"book\":\"Splunk\"}"
| rename jsonData as _raw
| spath

If your data is indeed not valid json and is of the same form as your example, you should still be able to define field extractions (search time) to extract them.

[jotne]

No need for the renaming to _raw

| makeresults
| eval jsonData="{\"author\":\"John\",\"book\":\"Splunk\"}"
| spath input=jsonData

[dmarling]

This will extract that information from _raw for any comma seperated key value pairing, which Splunk will do normally without much prompting, but this format is an odd format since it's wrapped in curly brackets like json, but contains a comma seperated key value pair instead of what I would expect from a json string.

| makeresults count=1
| eval _raw="{author=John, book=Splunk }"
| extract kvdelim="=" pairdelim=","

If your goal is to not have the curly bracket get picked up you can just remove it prior to the extract with this:

| makeresults count=1
| eval _raw="{author=John, book=Splunk }"
| rex field=_raw mode=sed "s/[\{\}]+//g"
| eval _raw=trim(_raw)
| extract kvdelim="=" pairdelim=","

[martin_mueller]

Does automatic key=value extraction not work?