Splunk Search

How to format output table for an object?

alpsplunkuser
Engager

I have a message that consists of key-value pairs:
"status=BLOCKED, identifier=123422dsd13, userId=12344, name=John"
I am using | extract pairdelim=", " kvdelim="=" to extract these key-value pairs.

As an output I would like to get a 2-columns table with rows that contain key in column1 and value in column2:


| Key | Value |
| status | BLOCKED |
| identifier | 123422dsd13 |
| userId | 12344 |
| name | John |

0 Karma
1 Solution

efavreau
Motivator

@alpsplunkuser I didn't need the kvdelim to get it to break into key value pairs in this example, but I don't have your data, so YMMV. I think the command you're looking for is untable. To use it in this run anywhere example below, I added a column I don't care about. Then untable it, to get the columns you want. Then use table to get rid of the column I don't want, leaving exactly what you were looking for.

| noop 
| stats count 
| eval _raw="Whatisthis=donotcare, status=BLOCKED, identifier=123422dsd13, userId=12344, name=John"
| extract pairdelim=", "
| untable Whatisthis Key Value
| table Key Value

https://docs.splunk.com/Documentation/Splunk/Latest/SearchReference/Untable

###

If this reply helps you, an upvote would be appreciated.

View solution in original post

efavreau
Motivator

@alpsplunkuser I didn't need the kvdelim to get it to break into key value pairs in this example, but I don't have your data, so YMMV. I think the command you're looking for is untable. To use it in this run anywhere example below, I added a column I don't care about. Then untable it, to get the columns you want. Then use table to get rid of the column I don't want, leaving exactly what you were looking for.

| noop 
| stats count 
| eval _raw="Whatisthis=donotcare, status=BLOCKED, identifier=123422dsd13, userId=12344, name=John"
| extract pairdelim=", "
| untable Whatisthis Key Value
| table Key Value

https://docs.splunk.com/Documentation/Splunk/Latest/SearchReference/Untable

###

If this reply helps you, an upvote would be appreciated.

DalJeanis
Legend

Try this instead

| rex field=NameOfMessageField max_match=0 "(?<Key>[^=,]+)=(?<Value>[^,]+)[, ]*"

alpsplunkuser
Engager

thanks for the reply, your approach also works to extract key-value pairs, but I am more interested in output format rather than parsing.

0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...