Splunk Search

Filter Search results

bansi
Path Finder

The search result produces output of a column in following format

Element[contractId=true,memberId=<null>,name=[Name [value=true,nameType=NAME]],dateOfBirth=true

Wondering if it is possible to filter the output of these columns to have just the keys and not key=value pairs i.e. have output like

contractId,memberId,name,dateOfBirth

instead of

contractId=true,memberId=<null>,name=[Name[value=true,nameType=NAME]],dateOfBirth=true
Tags (1)
0 Karma

southeringtonp
Motivator

Take a look at the rex command. There are multiple ways you could do it, but here's one:

| rex field=yourfield max_match=50 "(?<key_list>[A-Za-z]+)="
| eval newfield=mvjoin(key_list,",")

You'll end up with the result in the new field key_list. Skip the second part if you want to keep it as a multi-valued field instead of merging them back into a single entry.

0 Karma

southeringtonp
Motivator

You will need to write a regex that matches your format, or possibly use the xpatch commands. Take a look at the docs for reg and xpath. If you use rex, you may want to try out Kodos or RegexBuddy to help you troubleshoot your regular expression.

0 Karma

bansi
Path Finder

How to extract values between Elements tag.


contract2_100



true
true




001



true
true

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...