Splunk Search

Converting event into fields and values

shakSplunk
Path Finder

Hi all,

I'm trying to convert the message body of my events into fields. 

The structure of the event message is in a comma delimeted key-value pair format. An example of the structure is:

TimeEvent
10/08/2021
15:09:49.000

Timestamp,10/08/2021 15:09:49,Environment,EUAT,Artefact,ICE,Application,ICE,Domain,ws,Status,RUNNING

10/08/2021
15:09:49.000
Timestamp,10/08/2021 15:09:49,Environment,EUAT,Artefact,ICE,Application,Radiating Whitespaced App,Domain,dc,Status,ERROR
10/08/2021
15:09:49.000
Timestamp,10/08/2021 15:09:49,Environment,DEV,Artefact,MC,Application,MCIO,AppID,4,Hostname,4569erg,Domain,wsdc,Status,STOPPED

 

Is there a way, through a search query to make every odd value a 'field' and every even value a corresponding 'value' for that field. Therefore, 'Timestamp' would be a field, with it's corresponding value, then 'Environment' would be the next field.

The tricky part is that there can be varying lengths of key-value pair strings in the events. For instance, the first row has 6 pairs of key-value pairs, whereas the third row has 8. 

Any help would be greatly appreciated!

Labels (3)
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| extract pairdelim="," kvdelim=","

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| extract pairdelim="," kvdelim=","
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...