How to format output table for an object?

[alpsplunkuser]

I have a message that consists of key-value pairs:
"status=BLOCKED, identifier=123422dsd13, userId=12344, name=John"
I am using | extract pairdelim=", " kvdelim="=" to extract these key-value pairs.

As an output I would like to get a 2-columns table with rows that contain key in column1 and value in column2:

| Key          | Value       |

| status       | BLOCKED     |

| identifier   | 123422dsd13 |

| userId       | 12344       |

| name         | John        |

[efavreau · Accepted solution]

@alpsplunkuser I didn't need the kvdelim to get it to break into key value pairs in this example, but I don't have your data, so YMMV. I think the command you're looking for is untable. To use it in this run anywhere example below, I added a column I don't care about. Then untable it, to get the columns you want. Then use table to get rid of the column I don't want, leaving exactly what you were looking for.

| noop 
| stats count 
| eval _raw="Whatisthis=donotcare, status=BLOCKED, identifier=123422dsd13, userId=12344, name=John"
| extract pairdelim=", "
| untable Whatisthis Key Value
| table Key Value

https://docs.splunk.com/Documentation/Splunk/Latest/SearchReference/Untable

[DalJeanis]

Try this instead

| rex field=NameOfMessageField max_match=0 "(?<Key>[^=,]+)=(?<Value>[^,]+)[, ]*"

[alpsplunkuser]

thanks for the reply, your approach also works to extract key-value pairs, but I am more interested in output format rather than parsing.