Splunk Search

How to auto dynamically extract all keyN to fields?

jbanAtSplunk
Communicator

Hi,

I have a log that will dynamically add "fields" to log record based on some logic.

It's syslog begging + payload that looks like (example)

Sep 10 16:52:07 11.11.11.11 Sep 10 16:52:07 process[111]: app=test&key0=value0&key1=value1&key2=key...&keyN=valueN

how to automatically/dynamically extract all keyN to fields.

Labels (1)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

How is the props.conf section for this sourcetype? (Also see Field extraction configuration especially KV_MODE.)  It is rather strange that Splunk doesn't already extract all pairs separated by =.

View solution in original post

0 Karma

jbanAtSplunk
Communicator

checked under the hood, looks like there is sourcetype transformations so that stanza didn't have KV_MODE.
I put KV_MODE=auto_escaped and it'll extract it automatically.

0 Karma

yuanliu
SplunkTrust
SplunkTrust

How is the props.conf section for this sourcetype? (Also see Field extraction configuration especially KV_MODE.)  It is rather strange that Splunk doesn't already extract all pairs separated by =.

0 Karma
Get Updates on the Splunk Community!

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...