Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Extract field value
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
Could anybody assist with this question - what method is the best to extract to new field value of "animal" key? Should I use eval or searchmatch or something else?
Here is example:
[some_date] ..."application":"some_app", "animal":"dog","segment":....
[some_date] ..."application":"some_app", "animal":"cat","segment":....
I need this variable to use in stats.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This should work:
| rex "\"animal\":\"(?<animal>[^\"]+)\""
Alternatively, you could try the following to apply key value extractions on your events. Whether this works properly depends on what exactly your full data looks like, but might be worth playing around with.
| extract pairdelim=",", kvdelim=":"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If it's json, use spath
Otherwise you can do something like this:
transforms.conf:
[my_kv_transform]
FORMAT = $1::$2
REGEX = \"([^"]+)\":\"([^"]+)\"
props.conf
[my_sourcetype]
REPORT-my_sourcetype_kv = my_kv_transform
This should do search-time extractions to get animal=dog and application=someapp
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This should work:
| rex "\"animal\":\"(?<animal>[^\"]+)\""
Alternatively, you could try the following to apply key value extractions on your events. Whether this works properly depends on what exactly your full data looks like, but might be worth playing around with.
| extract pairdelim=",", kvdelim=":"
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Unlocking Unified Insights: New Gigamon Federated Search App for Splunk
GA: New Data Management App in Splunk Platform
Announcing Modern Navigation: A New Era of Splunk User Experience
