Splunk Search

How to I extract survey results from an event where question/answer pairs are delimited by "," and key-values are delimited by "|"?

hqw
Path Finder

Dear all,

I want to extract results from a field, but I'm facing some problems. Could you pls kindly guide me on what is wrong? The survey result is contained in the label and I have 11 questions in this survey:

surveyResult:Q1|B,Q2|B,Q3|A,Q4|A,Q5|B,Q6|B,Q7|A,Q8|B,Q9|B,QG|B,QA|D,Completed 

My expected result:

Q1 Q2 Q3 Q4 Q5 Q6 Q7 Q8 Q9 QG QA
B  B  A  A  B  B  A  B  B  B  D 

Event:

action="Survey-launcher-temporary" label="|/mnt/sdcard/AppLoaderCache/CameraPreviews/31945694/20150626_095405|1435312470|1435312597|surveyResult:Q1|B,Q2|B,Q3|B,Q4|A,Q5|A,Q6|B,Q7|B,Q8|A,Q9|B,QG|A,QA|B,Completed" mount_description="FPH-JEM-F7R2. MountLocation:Laundry Care. M8" mount_id="05ddb79f0f8c11e5870e0647ae8d6515" shop_tags="xwalk-library, MassRebootTarget, M8, ZoneLocation-West, AreaLocation-Shopping-District, Hypermarket, Survey-AB, Singapore, Fairprice-JEM, Fairprice-Xtra, Fairprice, OutletLocation-Shopping-Mall, LIVE" timezone_id="Asia/Singapore" timezone_offset="28800000" value="0"
0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

This is a case for: Extract man!

action="Survey-launcher-temporary" | extract pairdelim="," kvdelim="|"

This should put your fields as you wish.

0 Karma

hqw
Path Finder

Hi alacercogitatus,

I tried this command, and i can get out the events, but nothing for statistics, it should due to that we didn't design the layouts, do you know how to improve this?

0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...