Splunk Search

Extracting one field into multiple fields

Path Finder

I have some data that looks similar to the following:

  Name: Record1
  Tags: [
      Key: Tag1
      Value: Value1
      Key: Tag2
      Value: Value2
      Key: Tag3
      Value: Value3

I am trying to create output table that looks like the following:

Name     Tag1    Tag2    Tag3
Record1  Value1  Value2  Value3

What have been trying to do so far is pathing into Tags and them combining them into one value, like so:

... | spath tags=Tags{} output=Tags | nomv Tags

This gives me one field with all the values that look like this:


I'm thinking what I need to do next is a foreach statement to extract those values into an eval field, but can't quite seem to get it. Keep in mind I don't know what the Tags will be actually named, what their value will be, or how many there are for any given record.

Any suggestions would be appreciated. Or if there is an easier way to accomplish this, I am open to anything. 🙂


0 Karma

Path Finder

Try using transforms and extract keys and values into different groups.

Enable multi value for the transforms

REGEX = \{\"key\"\:\"([^\"]+)\",\"value\"\:\"([^\"]+)

and use above transforms like below in search

search | extract keyvaluepairs

0 Karma