Can extract or kv command be limited to a specific field?

[recurse]

It seems the extract/kv command uses _raw as input to do its parsing. Is there any way to pass a previously extracted field to it instead?

Given this sample event:

| stats count
| eval _raw="messageToParse=\"key1:val1,key2:val2,key3:val3\" user=\"user123\" application=\"app123\" host=\"host123\""

I'm looking for something similar to:

| extract kvdelim=":" pairdelim="," input=messageToParse

to produce a table of:

key1    |    key2    |    key3
val1    |    val2    |    val3

Note: The number of kvps in messageToParse is greater than 50, so parsing them individually via regex is not suitable.

Any ideas?

[somesoni2 · Accepted solution]

One workaround is this

| gentimes start=-1 | eval _raw="messageToParse=\"key1:val1,key2:val2,key3:val3\" user=\"user123\" application=\"app123\" host=\"host123\"" | table _raw | extract  | rename _raw as temp messageToParse as _raw | extract kvdelim=":=" pairdelim=", " | rename _raw as messageToParse | rename temp as _raw

[recurse]

Thanks for the reply - I saw something similar in another post as well I think. The trouble I had was finding a way to limit the results in the table/output to only the keys parsed from messageToParse, instead of including user,application, etc, without manually specifying each key to display.

[somesoni2]

If in your final results, you only want to show keys which are included in messageToParse, they try like this

| gentimes start=-1 | eval _raw="messageToParse=\"key1:val1,key2:val2,key3:val3\" user=\"user123\" application=\"app123\" host=\"host123\"" | table _raw | extract  | table messageToParse| rename messageToParse as _raw | extract kvdelim=":=" pairdelim=", " | fields - _raw