Splunk Search

How do you do an automatic extraction based on the SPL 'extract' command?

pkeller
Contributor

Using:

index=default sourcetype=my:sourcetype
| extract pairdelim="][", kvdelim="=", auto=f

  Feb 19 09:44:02 foobar Feb 19 2019 09:44:02.322 UTC :  [My Port=2000][Device name=MyDevice][Device IP address=10.3.36.10][Device type=11]

Splunk extracts fields named:

My_Port, Device_name, Device_IP_Address, Device_type

Is there a props extract that will do the same as an automatic extraction, when there will be many unique kv pairs in events with this sourcetype?

Tags (3)
0 Karma
1 Solution

chrisyounger
SplunkTrust
SplunkTrust

Hi @pkeller

You can use this regular expression to do the same thing:

props.conf

[extract_square_pairs]
REGEX  =  \[(?<_KEY_1>[^=\]]+)=(?<_VAL_1>[^\]]+)\]

all then call extract_square_pairs from your props.conf

[SOURCETYPE]
REPORT-extract_square_pairs = extract_square_pairs
KV_MODE = none

Hope this helps!

View solution in original post

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Hi @pkeller

You can use this regular expression to do the same thing:

props.conf

[extract_square_pairs]
REGEX  =  \[(?<_KEY_1>[^=\]]+)=(?<_VAL_1>[^\]]+)\]

all then call extract_square_pairs from your props.conf

[SOURCETYPE]
REPORT-extract_square_pairs = extract_square_pairs
KV_MODE = none

Hope this helps!

0 Karma

pkeller
Contributor

Yes! It helped. Perfectly communicated, and works so well.
Thank you!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...