Splunk Search

How can I get field extractions from a dictionary in a log?



I've done this before but I am rusty. My log looks like this

1/2/2019 12:34pm priority=info soemthing=12  mydictionary={"iq":"123", "lovescars":"True"}

Where mydictionary can as many as 30 elements in it. How do I get those into fields?

0 Karma


Hi daniel333,

try something like this in your transforms.conf:

 SOURCE_KEY = mydictionary
 REGEX  = "([^"]+)":"([^"]+)"
 FORMAT = $1::$2

and this in your props.conf

 REPORT-000-GetFieldAndValueFromDict = GetFieldAndValueFromDict

This will create a field name from capturing group one and the value from capturing group two from within the dict.
Put that on your search head and it will work at search time.

Hope this helps ...

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...