Splunk Search

Key-value pair extraction -- regex help

koshyk
Super Champion

We have some snmp data and want to extract the data as a key-value pair

Sample

var.12345.5.5 = INTEGER: 10 myTag::var.12345.5.9 = STRING: "abc"    myTag::var.12345.5.3 = STRING: "admin"  myTag::var.12345.5.4 = STRING: "developer"
var.12345.5.5 = INTEGER: 10 myTag::var.12345.5.9 = STRING: "xyz"    myTag::var.12345.5.3 = STRING: "user1"  myTag::var.12345.5.4 = STRING: "support"

output required

var_12345_5_9,var_12345_5_3,var_12345_5_4
abc,admin,developer
xyz,user1,support

I tried a basic

REGEX=var\.([^ ]+)\s=\s(\S+)
FORMAT = $1::$2
CLEAN_KEYS = true

But can you please help in making it a bit more better?

0 Karma
1 Solution

somesoni2
Revered Legend

Try this

REGEX=(var\S+)\s+=\s+[^\"]+([^\"]+)
FORMAT = $1::$2
CLEAN_KEYS = true

View solution in original post

somesoni2
Revered Legend

Try this

REGEX=(var\S+)\s+=\s+[^\"]+([^\"]+)
FORMAT = $1::$2
CLEAN_KEYS = true

koshyk
Super Champion

cheers. it worked. I had to make a slight amendment, but the concept is the same.

0 Karma
Get Updates on the Splunk Community!

Application management with Targeted Application Install for Victoria Experience

  Experience a new era of flexibility in managing your Splunk Cloud Platform apps! With Targeted Application ...

Index This | What goes up and never comes down?

January 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Splunkers, Pack Your Bags: Why Cisco Live EMEA is Your Next Big Destination

The Power of Two: Splunk + Cisco at "Ludicrous Scale"   You know Splunk. You know Cisco. But have you seen ...