Splunk Search

How can I get field extractions from a dictionary in a log?

daniel333
Builder

All,

I've done this before but I am rusty. My log looks like this

1/2/2019 12:34pm priority=info soemthing=12  mydictionary={"iq":"123", "lovescars":"True"}

Where mydictionary can as many as 30 elements in it. How do I get those into fields?

0 Karma

MuS
Legend

Hi daniel333,

try something like this in your transforms.conf:

 [GetFieldAndValueFromDict]
 SOURCE_KEY = mydictionary
 REGEX  = "([^"]+)":"([^"]+)"
 FORMAT = $1::$2

and this in your props.conf

 [mySourceType]
 REPORT-000-GetFieldAndValueFromDict = GetFieldAndValueFromDict

This will create a field name from capturing group one and the value from capturing group two from within the dict.
Put that on your search head and it will work at search time.

Hope this helps ...

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...