Splunk Search

Basic Key Value extraction

erichard
Explorer

Hello,

I receive message like this :

 topic="Sniffer" message=""timestamp"="1524387631351","process"="com.x.android.apps","packageName"="com.google.android.gms","type"="URL","URL"="https://x.x.com/UploadConfigurationService/UnitUploadSettings/x071x?clientId=xx-mobile""
topic="Sniffer" message=""timestamp"="1524387779884","process"="com.google.android.gms","packageName"="com.google.android.gms","type"="URL","URL"="https://android.clients.google.com/c2dm/register3""

and I need to extract all key/value from "message=" without knowing the fields, I have only the syntaxe KV so here I would like to have :

process : com.x.android.apps
packageName : com.google.android.gms
...

I try without sucess :

index=devices Sniffer  |  rex field=_raw ".*message=\"(?<message>.*)\"" |   extract pairdelim="," kvdelim="=" |table  *

Any idea ?

Thanks for your help 😉

Tags (2)
0 Karma
1 Solution

niketnilay
Legend

@erichard, try the following run anywhere search based on sample data provided. (Commands from | makeresults to | rename data as _raw generate dummy data. Assuming you have two events starting from topic field)

| makeresults
| eval data="topic=\"Sniffer\" message=\"\"timestamp\"=\"1524387631351\",\"process\"=\"com.x.android.apps\",\"packageName\"=\"com.google.android.gms\",\"type\"=\"URL\",\"URL\"=\"https://x.x.com/UploadConfigurationService/UnitUploadSettings/x071x?clientId=xx-mobile\"\"; topic=\"Sniffer\" message=\"\"timestamp\"=\"1524387779884\",\"process\"=\"com.google.android.gms\",\"packageName\"=\"com.google.android.gms\",\"type\"=\"URL\",\"URL\"=\"https://android.clients.google.com/c2dm/register3\"\""
| makemv data delim=";"
| mvexpand data
| rename data as _raw
| rex ".*message=\"(?<message>.*)\"" 
| rename message as _raw
| extract pairdelim="," kvdelim="="
| table *
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketnilay
Legend

@erichard, try the following run anywhere search based on sample data provided. (Commands from | makeresults to | rename data as _raw generate dummy data. Assuming you have two events starting from topic field)

| makeresults
| eval data="topic=\"Sniffer\" message=\"\"timestamp\"=\"1524387631351\",\"process\"=\"com.x.android.apps\",\"packageName\"=\"com.google.android.gms\",\"type\"=\"URL\",\"URL\"=\"https://x.x.com/UploadConfigurationService/UnitUploadSettings/x071x?clientId=xx-mobile\"\"; topic=\"Sniffer\" message=\"\"timestamp\"=\"1524387779884\",\"process\"=\"com.google.android.gms\",\"packageName\"=\"com.google.android.gms\",\"type\"=\"URL\",\"URL\"=\"https://android.clients.google.com/c2dm/register3\"\""
| makemv data delim=";"
| mvexpand data
| rename data as _raw
| rex ".*message=\"(?<message>.*)\"" 
| rename message as _raw
| extract pairdelim="," kvdelim="="
| table *
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

erichard
Explorer

@niketnilay Many thanks !!!

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!