Splunk Search

Key-Value extraction using rex function

josknigh
Engager

Is it possible to use the rex command to do a dynamic key=value extraction where they key is a also a regular expression?

I know this can be done with a transform using:

REGEX = (,*?)=(.*?)

FORMAT = $1::$2

Can I do the same thing using rex instead? Maybe something like:

rex field=_raw "(?P<\\FIELDNAME>.*?)=(?<\\VALUE>.*?)"

Is their something I'm missing in the group naming syntax?

I'm looking for a way to do this at search-time rather than index-time without writing a transform.

lguinn2
Legend

I don't know how to do this with rex, but have you looked at using the DELIMS key word in transforms.conf? If there is a regular pattern in your data that defines fields

name:value name2:value2

then you can specify that with

DELIMS = " ", ":"

More details re: transforms.conf are here Take a look at the examples at the very end of the page.

Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...