Splunk Search

How to auto dynamically extract all keyN to fields?

jbanAtSplunk
Path Finder

Hi,

I have a log that will dynamically add "fields" to log record based on some logic.

It's syslog begging + payload that looks like (example)

Sep 10 16:52:07 11.11.11.11 Sep 10 16:52:07 process[111]: app=test&key0=value0&key1=value1&key2=key...&keyN=valueN

how to automatically/dynamically extract all keyN to fields.

Labels (1)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

How is the props.conf section for this sourcetype? (Also see Field extraction configuration especially KV_MODE.)  It is rather strange that Splunk doesn't already extract all pairs separated by =.

View solution in original post

0 Karma

jbanAtSplunk
Path Finder

checked under the hood, looks like there is sourcetype transformations so that stanza didn't have KV_MODE.
I put KV_MODE=auto_escaped and it'll extract it automatically.

0 Karma

yuanliu
SplunkTrust
SplunkTrust

How is the props.conf section for this sourcetype? (Also see Field extraction configuration especially KV_MODE.)  It is rather strange that Splunk doesn't already extract all pairs separated by =.

0 Karma
Get Updates on the Splunk Community!

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...

Platform Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestIntroducing Splunk Edge Processor, simplified data ...