Splunk Search

How to auto dynamically extract all keyN to fields?

jbanAtSplunk
Communicator

Hi,

I have a log that will dynamically add "fields" to log record based on some logic.

It's syslog begging + payload that looks like (example)

Sep 10 16:52:07 11.11.11.11 Sep 10 16:52:07 process[111]: app=test&key0=value0&key1=value1&key2=key...&keyN=valueN

how to automatically/dynamically extract all keyN to fields.

Labels (1)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

How is the props.conf section for this sourcetype? (Also see Field extraction configuration especially KV_MODE.)  It is rather strange that Splunk doesn't already extract all pairs separated by =.

View solution in original post

0 Karma

jbanAtSplunk
Communicator

checked under the hood, looks like there is sourcetype transformations so that stanza didn't have KV_MODE.
I put KV_MODE=auto_escaped and it'll extract it automatically.

0 Karma

yuanliu
SplunkTrust
SplunkTrust

How is the props.conf section for this sourcetype? (Also see Field extraction configuration especially KV_MODE.)  It is rather strange that Splunk doesn't already extract all pairs separated by =.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...