Splunk Search

Key-Value extraction using rex function

josknigh
Engager

Is it possible to use the rex command to do a dynamic key=value extraction where they key is a also a regular expression?

I know this can be done with a transform using:

REGEX = (,*?)=(.*?)

FORMAT = $1::$2

Can I do the same thing using rex instead? Maybe something like:

rex field=_raw "(?P<\\FIELDNAME>.*?)=(?<\\VALUE>.*?)"

Is their something I'm missing in the group naming syntax?

I'm looking for a way to do this at search-time rather than index-time without writing a transform.

lguinn2
Legend

I don't know how to do this with rex, but have you looked at using the DELIMS key word in transforms.conf? If there is a regular pattern in your data that defines fields

name:value name2:value2

then you can specify that with

DELIMS = " ", ":"

More details re: transforms.conf are here Take a look at the examples at the very end of the page.

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...