Splunk Search

How to extract data from quotation marks?

Lazous
Engager

Hello, 
I am trying to extract the data from the following message:
the header data is in quotes and for each header data there is a set of secondary data also in quotes.
The events are presented as follows:

{Name=SS, PId=236}
PROD {Type=A_OUTGOING, Id=7934,plan=8975, Conflict=2529, Date=2023-04-18T18:51:00.000+02:00}
PROD {Type=B_OUTGOING, Id=7934, plan=8975, Conflict=72482, Date=2023-04-18T18:51:00.000+02:00}
{Name=DAG, PId=55}
PROD {Type=B_INCOMING, Id=7921, plan=8975, Conflict=64870, Date=2023-04-18T18:51:00.000+02:00}

The following result is expected:

Name   PId  Type  Id  plan Conflict  Date
SS 236 A_OUTGOING 7934 8975 2529 2023-04-18T18:51:00.000+02:00
SS 236 B_OUTGOING 7934 8975 72482 2023-04-18T18:51:00.000+02:00
DAG 55 B_INCOMING 7921 8975 64870 2023-04-18T18:51:00.000+02:00

 

Would you please help? Thanking you

Labels (1)
0 Karma

woodcock
Esteemed Legend

That data is JSON so the quick/easy/wrong fix is just to add this to your search:
| kv

But the better answer is to add this to your props.conf for your source/sourcetype:
KV_MODE = json

0 Karma

Lazous
Engager

i tried adding the | kv,

and i do not get all the data  in the result set.

am not allowed to edit the  props.conf

0 Karma

woodcock
Esteemed Legend

| makeresults
| eval raw="{Name=SS, PId=236}
PROD {Type=A_OUTGOING, Id=7934,plan=8975, Conflict=2529, Date=2023-04-18T18:51:00.000+02:00}
PROD {Type=B_OUTGOING, Id=7934, plan=8975, Conflict=72482, Date=2023-04-18T18:51:00.000+02:00} {Name=DAG, PId=55}
PROD {Type=B_INCOMING, Id=7921, plan=8975, Conflict=64870, Date=2023-04-18T18:51:00.000+02:00}"
| makemv delim="
" raw
| mvexpand raw
| rename raw AS _raw
| kv

ITWhisperer
SplunkTrust
SplunkTrust

Given that this looks like it might be JSON, have you tried using spath?

0 Karma

Lazous
Engager

would you please specify how the command would look like in this case ? 

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Index This | What travels the world but is also stuck in place?

April 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data

Realizing the full potential of your Splunk investment requires more than just understanding current usage; it ...

Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...

As data volumes continue to grow and environments become more distributed, managing and optimizing data ...