Hi,
So assuming your key value extraction is working fine and there is an attribute named attrs already then you can simply do:
| eval attrib_extraction = split(attrs, " ")
If that's not the case you can extract key value pairs from your raw data using the kv command.
Alternatively a simple regex like the following should do the trick too:
| rex "attrs=\"(?<attrib_extraction_all>[^\"]+)\""
| rex max_match=0 field=attrib_extraction_all "(?<attrib_extraction>\S+)"
If you then need to expand this multivalued field simply do:
| mvexpand attrib_extraction
Hope that helps.
Thanks,
J
