Splunk Search

Is it possible to extract nested data make 2 keys?

batabay
Engager

Hi Splunkers,

I have data like this, 

Primary Key_1:

     subkey_1 : subvalue_1

     subkey_2 : subvalue_2

Primary Key_2:

     subkey_1 : subvalue_1

     subkey_2 : subvalue_2

 

I extract data like this, But I want to see in splunk like key1.subkey_1 = sub_value_1

batabay_0-1664448881683.png

 

Btw, this is one event.

I try in transforms.conf ($1::$2:):$3 , But I failed.

And I want to extract this data, What is the best way extract this for as I want. Or is that possible ? 

 

Labels (1)
Tags (3)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

If the data is highly formatted as illustrated and assuming primary key names and values do not contain space, I'd turn the string into conformant data using the following, then you can use spath to extract.

 

| rex mode=sed max_match=0 "s/([^:\s]+)\s*:/\"\1\":/g"
| rex mode=sed max_match=0 "s/: +(\S+)/:\"\1\"/g"
| rex mode=sed "s/^\"/{\"/g"
| rex mode=sed max_match=0 "s/(\s+)\"/\1{\"/g"
| rex mode=sed max_match=0 "s/\"\s\s+{/\", /g"
| rex mode=sed "s/\"\s+{/\"},
 /"
| rex mode=sed "s/\"$/\"}
}/"
| spath

 

PrimaryKey_1.subkey_1PrimaryKey_1.subkey_2PrimaryKey_2.subkey_1PrimaryKey_2.subkey_2
subvalue_1subvalue_2subvalue_1subvalue_2

In case you have this question in mind: This cannot be implemented in transforms.conf.

View solution in original post

0 Karma

yuanliu
SplunkTrust
SplunkTrust

If the data is highly formatted as illustrated and assuming primary key names and values do not contain space, I'd turn the string into conformant data using the following, then you can use spath to extract.

 

| rex mode=sed max_match=0 "s/([^:\s]+)\s*:/\"\1\":/g"
| rex mode=sed max_match=0 "s/: +(\S+)/:\"\1\"/g"
| rex mode=sed "s/^\"/{\"/g"
| rex mode=sed max_match=0 "s/(\s+)\"/\1{\"/g"
| rex mode=sed max_match=0 "s/\"\s\s+{/\", /g"
| rex mode=sed "s/\"\s+{/\"},
 /"
| rex mode=sed "s/\"$/\"}
}/"
| spath

 

PrimaryKey_1.subkey_1PrimaryKey_1.subkey_2PrimaryKey_2.subkey_1PrimaryKey_2.subkey_2
subvalue_1subvalue_2subvalue_1subvalue_2

In case you have this question in mind: This cannot be implemented in transforms.conf.

0 Karma

batabay
Engager

Some of pieces of data different but I'll try to change. The answer is correct.

0 Karma

jdunlea
Contributor

Presumably this is a multi line event?

Are there finite limits to how many primary keys will be in the data? Like are there always 2 primary keys? Or could there be more/less depending on the event that comes in?

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...