Splunk Search

How to extract and display in a table form?

Manth
Explorer

I have splunk logs as given below. However, I wanted display fields in between square brackets "[ ]" in a table as given below. Please advise.

Expeted query result in a table

sqsMsgId                                                                        | snsMsgId                                                                        | requestId

dec6c564-9e1c-4d0f-8e5e-ac9dc7bdf14a  | 7d81b4cf-43c0-5bb4-8370-ef064a78da16 | d487108c-863f-5ab2-96df-4b458f97c74e

My splunk Logs

{"level":"info","message":"[sqsMsgId=dec6c564-9e1c-4d0f-8e5e-ac9dc7bdf14a | snsMsgId=7d81b4cf-43c0-5bb4-8370-ef064a78da16 | workItemKey=CAMP:MI4:ORG_ID:103857:7fbf0f46-4131-404d-9a13-57cdff7c473a | requestId=d487108c-863f-5ab2-96df-4b458f97c74e | status=SUCCESS | ags=CAMP | component=MI4 | duration=383]","requestId":"d487108c-863f-5ab2-96df-4b458f97c74e"}

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex "sqsMsgId=(?<sqsMsgId>\S+)\s.*?snsMsgId=(?<snsMsgId>\S+)\s.*?requestId=(?<requestId>\S+)\s"
0 Karma

Manth
Explorer

Thank you for your quick response. However, I would like to display key value fields in table where field delimiter is "|" and key-value delimiter is "=". Please advise.

0 Karma

johnhuang
Motivator
<base_search>
| rex "^[^\[]*\[(?<_raw>[^\]]*)"
| extract pairdelim="|" kvdelim="="
0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...