How do you do an automatic extraction based on the SPL 'extract' command?

[pkeller]

Using:

index=default sourcetype=my:sourcetype
| extract pairdelim="][", kvdelim="=", auto=f

  Feb 19 09:44:02 foobar Feb 19 2019 09:44:02.322 UTC :  [My Port=2000][Device name=MyDevice][Device IP address=10.3.36.10][Device type=11]

Splunk extracts fields named:

My_Port, Device_name, Device_IP_Address, Device_type

Is there a props extract that will do the same as an automatic extraction, when there will be many unique kv pairs in events with this sourcetype?

[chrisyounger · Accepted solution]

Hi @pkeller

You can use this regular expression to do the same thing:

props.conf

[extract_square_pairs]
REGEX  =  \[(?<_KEY_1>[^=\]]+)=(?<_VAL_1>[^\]]+)\]

all then call extract_square_pairs from your props.conf

[SOURCETYPE]
REPORT-extract_square_pairs = extract_square_pairs
KV_MODE = none

Hope this helps!

[pkeller]

Yes! It helped. Perfectly communicated, and works so well.
Thank you!