Splunk Search

How do I extract Key Value pairs from Ruby on Rails logs?

Simeon
Splunk Employee
Splunk Employee

I am trying to extract field and key/value parameters from a ruby on rails log file. What ways can I do this? My events have Parameters in the following format:

Processing blah blah blah
  Parameters:  {"item1"=>"food", "item2"=>"drink", "item3"=>"water"}

Simeon
Splunk Employee
Splunk Employee

You can do this via configuration files or search-time "kv" (aka extract command). Specifically, for your situation you want to delimit based on the "=>" and ", ". You can use the extract command as follows:

... | extract pairdelim=", }{", kvdelim="=>", auto=f 

This will turn off auto extraction, break the key value pairs based on the =>, and break the pairs based on the "," whitespace, or either curly bracket. So your extracted fields would be:

item1=food
item2=drink
item3=water
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...