How do I extract nested key-value pairs from my sample data to use in an email alert?

[mattnovak]

I'm attempting to use some KV pairs as tokens (i.e., $result.configuration$ and $result.version$) in an email alert. How do I go about extracting the KV pairs out in the search, including the nested KV pairs from the 'message' field?

[2016-04-28 23:09:17-0600]  build_id=a93737e configuration=blackrussian caller=_deploy-video-client level=lifecycle lifecycle='CMDB' message='event=deploy user=hudson component=video-client version=1.0.3-49 platform=darwin arch=x86_64 target=blackrussian'

Thanks in advance for the help!

[mattnovak · Accepted solution]

Ok, so I figured it out. If I pipe the search result to the fields command, then the autoextraction thing works. So it's just " | fields configuration, component, etc...", and that gives me my tokens for use in the email.

Just dropping that there in case anyone else has the same issue. Thanks for the help!

[somesoni2]

Is the kv pair not automatically extracted as fields in Splunk? By using KV value as token, where do you want to use in email alert (subject/body etc)?

[mattnovak]

It doesn't seem to be. And yes, I'm trying to inject them into an tokenized string and the email keeps coming in with null token results.

For instance,

CMDB: $result.configuration$ $result.component$ Deployment

comes in as

CMDB: Deployment

[somesoni2]

What is your email alert search that you're using?