Splunk Search

How can I extract these fields to have a table output with the field value (AAAAA) rather than name="AAAAA"?

isabellechristo
New Member

Hello,

I have _raw data like this:
time , name="AAAAAA",first_name="BBBBB"

When I look with table I saw this :

_time                name                    first_name
12/20/2017    name="AAAAA"   first_name="BBBBB"

How can I have the output result in showing the fields this way instead:

_time                name                    first_name
12/20/2017    "AAAAA"                 "BBBBB"

Thank you for your help

0 Karma

nickhills
Ultra Champion

To quickly fix this, so you can render your table correctly try:

<your search>|rex field=name "name=(?<newname>.*)"|rex field=first_name "first_name=(?<newfirst_name>.*)"|table _time newname newfirst_name

However as @richgalloway points out - you should probably fix this in props.conf

If my comment helps, please give it a thumbs up!
0 Karma

lukas_loder
Communicator

If you use it only once you can try it with this command

| rex field=_raw "name=\"(?<name>[^\"].+)\",first_name=\"(?<first_name>[^\"].+)\""

If you are using it more then one. Try to extract new fields with the field extractor. There you can also use the regex from above.

0 Karma

msivill_splunk
Splunk Employee
Splunk Employee

Standalone example using rex and overwriting existing field values

| makeresults 
| eval name = "name=\"AAAA\"" 
| eval first_name = "first_name=\"BBBB\"" 
| rex field=name "name=(?<name>.*)" 
| rex field=first_name "first_name=(?<first_name>.*)"

Standalone example showing further field extractions with rex (in case you wanted to remove the quotes)

| makeresults 
| eval name = "name=\"AAAA\"" 
| eval first_name = "first_name=\"BBBB\"" 
| rex field=name "name=(?<name2>.*)" 
| rex field=name "name=\"(?<name3>.*)\"" 
| rex field=first_name "first_name=(?<first_name2>.*)" 
| rex field=first_name "first_name=\"(?<first_name3>.*)\""
0 Karma

richgalloway
SplunkTrust
SplunkTrust

It's probably something simple like adding kv_mode = auto to your props.conf file. We could help more if you would share the props.conf settings for that sourcetype.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...