Splunk Search

Converting event into fields and values

shakSplunk
Path Finder

Hi all,

I'm trying to convert the message body of my events into fields. 

The structure of the event message is in a comma delimeted key-value pair format. An example of the structure is:

TimeEvent
10/08/2021
15:09:49.000

Timestamp,10/08/2021 15:09:49,Environment,EUAT,Artefact,ICE,Application,ICE,Domain,ws,Status,RUNNING

10/08/2021
15:09:49.000
Timestamp,10/08/2021 15:09:49,Environment,EUAT,Artefact,ICE,Application,Radiating Whitespaced App,Domain,dc,Status,ERROR
10/08/2021
15:09:49.000
Timestamp,10/08/2021 15:09:49,Environment,DEV,Artefact,MC,Application,MCIO,AppID,4,Hostname,4569erg,Domain,wsdc,Status,STOPPED

 

Is there a way, through a search query to make every odd value a 'field' and every even value a corresponding 'value' for that field. Therefore, 'Timestamp' would be a field, with it's corresponding value, then 'Environment' would be the next field.

The tricky part is that there can be varying lengths of key-value pair strings in the events. For instance, the first row has 6 pairs of key-value pairs, whereas the third row has 8. 

Any help would be greatly appreciated!

Labels (3)
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| extract pairdelim="," kvdelim=","

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| extract pairdelim="," kvdelim=","
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...