Splunk Search

How to format output table for an object?

alpsplunkuser
Engager

I have a message that consists of key-value pairs:
"status=BLOCKED, identifier=123422dsd13, userId=12344, name=John"
I am using | extract pairdelim=", " kvdelim="=" to extract these key-value pairs.

As an output I would like to get a 2-columns table with rows that contain key in column1 and value in column2:


| Key | Value |
| status | BLOCKED |
| identifier | 123422dsd13 |
| userId | 12344 |
| name | John |

0 Karma
1 Solution

efavreau
Motivator

@alpsplunkuser I didn't need the kvdelim to get it to break into key value pairs in this example, but I don't have your data, so YMMV. I think the command you're looking for is untable. To use it in this run anywhere example below, I added a column I don't care about. Then untable it, to get the columns you want. Then use table to get rid of the column I don't want, leaving exactly what you were looking for.

| noop 
| stats count 
| eval _raw="Whatisthis=donotcare, status=BLOCKED, identifier=123422dsd13, userId=12344, name=John"
| extract pairdelim=", "
| untable Whatisthis Key Value
| table Key Value

https://docs.splunk.com/Documentation/Splunk/Latest/SearchReference/Untable

###

If this reply helps you, an upvote would be appreciated.

View solution in original post

efavreau
Motivator

@alpsplunkuser I didn't need the kvdelim to get it to break into key value pairs in this example, but I don't have your data, so YMMV. I think the command you're looking for is untable. To use it in this run anywhere example below, I added a column I don't care about. Then untable it, to get the columns you want. Then use table to get rid of the column I don't want, leaving exactly what you were looking for.

| noop 
| stats count 
| eval _raw="Whatisthis=donotcare, status=BLOCKED, identifier=123422dsd13, userId=12344, name=John"
| extract pairdelim=", "
| untable Whatisthis Key Value
| table Key Value

https://docs.splunk.com/Documentation/Splunk/Latest/SearchReference/Untable

###

If this reply helps you, an upvote would be appreciated.

DalJeanis
SplunkTrust
SplunkTrust

Try this instead

| rex field=NameOfMessageField max_match=0 "(?<Key>[^=,]+)=(?<Value>[^,]+)[, ]*"

alpsplunkuser
Engager

thanks for the reply, your approach also works to extract key-value pairs, but I am more interested in output format rather than parsing.

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...