Splunk Search

Help in field extraction/transformation

Path Finder

I have a JSON log entry with  key-value pairs within the field component. I'm trying to transform the field into sub-fields using the key-value pairs. 


"msg":{"additionalValues":"{responseTime=137, synapseTag=None, serviceName=switching-integration, uri=com.bigcompany.switching, responseCode=200}", <more fields>,...}

For Splunk,  I can pull one field, referenced as "msg.additionalValues". But I can't seem to transform the KVP's within that field into sub-fields.  (such as "msg.additionalvalues.responseTime", and msg.additionalvalues.synapseTag, etc ) 

Any ideas? 


Labels (1)
Tags (2)
0 Karma


Hi @timgren 

It looks like the solution in other post might satisfy your requirement. Solved: Re: How to extract fields from child node - Splunk Community 


An upvote would be appreciated if it helps!

0 Karma

Path Finder

Well, Not really as that is an inline rex of known fields, not a transformation of subfields which can be a variety of names.  But thanks. A transformation at time of ingestion is what I'm after. 


0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...