Splunk Search

How to format output table for an object?

alpsplunkuser
Engager

I have a message that consists of key-value pairs:
"status=BLOCKED, identifier=123422dsd13, userId=12344, name=John"
I am using | extract pairdelim=", " kvdelim="=" to extract these key-value pairs.

As an output I would like to get a 2-columns table with rows that contain key in column1 and value in column2:


| Key | Value |
| status | BLOCKED |
| identifier | 123422dsd13 |
| userId | 12344 |
| name | John |

0 Karma
1 Solution

efavreau
Builder

@alpsplunkuser I didn't need the kvdelim to get it to break into key value pairs in this example, but I don't have your data, so YMMV. I think the command you're looking for is untable. To use it in this run anywhere example below, I added a column I don't care about. Then untable it, to get the columns you want. Then use table to get rid of the column I don't want, leaving exactly what you were looking for.

| noop 
| stats count 
| eval _raw="Whatisthis=donotcare, status=BLOCKED, identifier=123422dsd13, userId=12344, name=John"
| extract pairdelim=", "
| untable Whatisthis Key Value
| table Key Value

https://docs.splunk.com/Documentation/Splunk/Latest/SearchReference/Untable

###

If this reply helps you, an upvote would be appreciated.

View solution in original post

efavreau
Builder

@alpsplunkuser I didn't need the kvdelim to get it to break into key value pairs in this example, but I don't have your data, so YMMV. I think the command you're looking for is untable. To use it in this run anywhere example below, I added a column I don't care about. Then untable it, to get the columns you want. Then use table to get rid of the column I don't want, leaving exactly what you were looking for.

| noop 
| stats count 
| eval _raw="Whatisthis=donotcare, status=BLOCKED, identifier=123422dsd13, userId=12344, name=John"
| extract pairdelim=", "
| untable Whatisthis Key Value
| table Key Value

https://docs.splunk.com/Documentation/Splunk/Latest/SearchReference/Untable

###

If this reply helps you, an upvote would be appreciated.

View solution in original post

DalJeanis
SplunkTrust
SplunkTrust

Try this instead

| rex field=NameOfMessageField max_match=0 "(?<Key>[^=,]+)=(?<Value>[^,]+)[, ]*"

alpsplunkuser
Engager

thanks for the reply, your approach also works to extract key-value pairs, but I am more interested in output format rather than parsing.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!