I have events that are added to an index using the Splunk Logging Driver for Docker. I would like to extract key-value pairs from the line field. I couldn't figure out how to do this with extract since it doesn't accept a field as a parameter. I tried to do it with rex and other methods but couldn't figure out how to get it to add individual key-value pairs and make the keys available as fields.
From the line field, I would like to extract the following keys: url, method, query, size, status, time, ip, phase. I could then use those fields in other Splunk functions to generate statistics.
I'm looking at how to make this extraction dynamic (different events may have different key-value pairs). The only thing in common is that they are in the line field and have key=value syntax. If more than one, then they are separated by a ,.