How to extract key value pairs out of a multivalue field?

[HeinzWaescher]

Hi,

is it possible to extract key value pairs out of a multivalue field like this:

multivaluefield: sales:100 ,refunds: 25

What I need is

multivaluefield.sales: 100
multivaluefield.refunds: 25

The amount of entries in the multivaluefield isn't constant, so there could be 1-n entries.

Thanks in advance
Heinz

[DalJeanis]

if you already have this in an actual Splunk multivalue field, then it goes like this -

| mvexpand multivaluefield
| rex field=multivaluefield "^(?[A-Za-z]+):(?[0-9]+)$"

So in your output, OneField will contain "sales" or "refunds" and OneValue will contain the respective values 100 or 25.

Also, if you have it in a single "flattened" field, separated by commas - since you're showing a comma in your example - then you may need to do this first

| makemv multivalued delim=","

[javiergn]

Hi, did any of the comments below help you on this?
If yes, can you mark it as answered?
If not, is there any else we can do to help?
Unanswered questions make me sad 😞

[HeinzWaescher]

Sorry, I did not have the time to work on it yet 😞
But it is on my list and, of course, I'll write feedback whether I have been able so solve my problem

[woodcock]

You should be able to do this with unanchored RegEx, like this in props.conf:

[mv_column_kvps]
FORMAT = $1::$2
MV_ADD = 1
REGEX = ([^:,]+)[:]\s*([^;,.=()]*)(?:\s*[,]|$)
SOURCE_KEY = multivaluefield
disabled = 1

[javiergn · Accepted solution]

Could you transform that multivalue field into JSON first and then use spath instead maybe?
For example:

| stats count
| fields - count
| eval multivaluefield = "sales:100,refunds: 25"
| eval multivaluefield_temp = multivaluefield
| fields - multivaluefield
| eval multivaluefieldJSON = "{ \"multivaluefield\" : {\"" . replace(replace(multivaluefield_temp, ":", "\":\""), ",", "\" , \""). "\"} }"
| spath input=multivaluefieldJSON

Output:

multivaluefield.refunds     multivaluefield.sales   multivaluefieldJSON     multivaluefield_temp
25  100     { "multivaluefield" : {"sales":"100" , "refunds":" 25"} }   sales:100,refunds: 25 

If not, would the following work for you maybe?

| stats count
| fields - count
| eval multivaluefield = split("sales:100,refunds: 25", ",")
| mvexpand multivaluefield
| eval temp = _raw
| eval _raw = multivaluefield
| extract kvdelim=":" pairdelim=","
| eval _raw = temp
| fields - temp

[HeinzWaescher]

the first option solves it, thanks a lot!