Splunk Search
Highlighted

How do you do an automatic extraction based on the SPL 'extract' command?

Contributor

Using:

index=default sourcetype=my:sourcetype
| extract pairdelim="][", kvdelim="=", auto=f

  Feb 19 09:44:02 foobar Feb 19 2019 09:44:02.322 UTC :  [My Port=2000][Device name=MyDevice][Device IP address=10.3.36.10][Device type=11]

Splunk extracts fields named:

My_Port, Device_name, Device_IP_Address, Device_type

Is there a props extract that will do the same as an automatic extraction, when there will be many unique kv pairs in events with this sourcetype?

Tags (3)
0 Karma
Highlighted

Re: How do you do an automatic extraction based on the SPL 'extract' command?

SplunkTrust
SplunkTrust

Hi @pkeller

You can use this regular expression to do the same thing:

props.conf

[extract_square_pairs]
REGEX  =  \[(?<_KEY_1>[^=\]]+)=(?<_VAL_1>[^\]]+)\]

all then call extract_square_pairs from your props.conf

[SOURCETYPE]
REPORT-extract_square_pairs = extract_square_pairs
KV_MODE = none

Hope this helps!

View solution in original post

0 Karma
Highlighted

Re: How do you do an automatic extraction based on the SPL 'extract' command?

Contributor

Yes! It helped. Perfectly communicated, and works so well.
Thank you!

0 Karma