Splunk Search

Extracting kv pars from a field in a json string

brent_weaver
Builder

I have a field in my JSON string like:

message: caas_tcp_est=12326 caas_bgp_est=0 caas_ovpn_elapsed=2288881 caas_ovpn_count=12318 caas_ovpn_memrss=7562140 mem_total=15657072 mem_free=5400856 mem_avail=7519920 cpu_util=3.43

How do I extract that iinto kvpairs? I see the extract command but dont understand know how it works.

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The extract command works in two ways to parse data. One is to invoke a transform defined in your transforms.conf file. The other uses in-line arguments to specify how KV pairs should be parsed. You'll likely want to use the second method. Try this. It tells the extract command that keys are separated from their values by an equals sign and each KV pair is separated by a space.

... | extract kvdelim="=" pairdelim=" " | ...
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...