Splunk Search

Extracting one field into multiple fields

BearMormont
Path Finder

I have some data that looks similar to the following:

{
  Name: Record1
  Tags: [
    {
      Key: Tag1
      Value: Value1
    }
    {
      Key: Tag2
      Value: Value2
    }
    {
      Key: Tag3
      Value: Value3
    }    
  ]
}

I am trying to create output table that looks like the following:

Name     Tag1    Tag2    Tag3
-------------------------------
Record1  Value1  Value2  Value3

What have been trying to do so far is pathing into Tags and them combining them into one value, like so:

... | spath tags=Tags{} output=Tags | nomv Tags

This gives me one field with all the values that look like this:

 {Key:Tag1,Value:Value1}{Key:Tag2,Value:Value2}{Key:Tag3,Value:Value3}

I'm thinking what I need to do next is a foreach statement to extract those values into an eval field, but can't quite seem to get it. Keep in mind I don't know what the Tags will be actually named, what their value will be, or how many there are for any given record.

Any suggestions would be appreciated. Or if there is an easier way to accomplish this, I am open to anything. 🙂

Thanks!

0 Karma

kyaparla
Path Finder

Try using transforms and extract keys and values into different groups.

Enable multi value for the transforms


[keyvaluepairs]
REGEX = \{\"key\"\:\"([^\"]+)\",\"value\"\:\"([^\"]+)
FORMAT=$1::$2

and use above transforms like below in search

search | extract keyvaluepairs

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...