Splunk Search

How do I edit my search to convert extracted field value pairs into a string?

New Member


I have recently started using json log lines which works great with Splunk. There is one issue, however, which I cannot resolve at the moment.
The idea is to construct the original request out of json object

I have a field with structure:
req.args.paramA = value1
req.args.paramB = value2
req.args.paramC = value3

What I want to have in the end is a string:


By design, I don't know param real names. Those can be changed, depending on what user submitted.
I tried using (as a test):

eval params= ""| foreach req.args.* [eval params=params + <>]

Gave me only Splunk errors...


0 Karma

Revered Legend

Give this a try

your current search | eval params="" | foreach req.args.* [eval params=params."<<FIELD>>=".'<<FIELD>>'."&" ]
0 Karma

New Member

Thanks. As i wrote i tried it, and it did not work. The problem was with wrong types. Had to use casting tostring

foreach req.args.* [eval params=params."<<FIELD>>=".tostring('<<FIELD>>')."&"]

Now i seems to almost get what i want. The problem is that keys now have full name and some params appear as null if those are missing on other events:


0 Karma

Revered Legend

You can use fillnull command to update those null values to something default. like this

your current search | eval params="" | fillnull value="NA" req.args.* | foreach req.args.* [eval params=params."<<FIELD>>=".tostring('<<FIELD>>')."&"]
0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!