For every segment that looks like 'field':'value'I want Splunk to treat the value in quotes BEFORE the : as the field name and the value in quotes AFTER the : as the value for the field (similar treatment to field="value", which is Splunk's default).
How do I achieve this through a regex treatment? For example, in the example above, I'd like my field and value pairs to be as follows:
This will take every value in single quotes before the colon as the field name and the value in single quotes after the colon as the value for that field. This will work for any format you can match in the extractions regex. As long as the key value pairs are consistent, it will grab them all.
If the field / value format is consistent, you can use <_KEY_1> and <_VAL_1> as your field names in your capture groups to dynamically extract all field value pairs. In your props.conf, under the sourcetype for these events add a field extraction like the following:
You may have to play with the regex a bit, but this should work. It will take everything in single quotes before the colon as a field name and everything after the colon in single quotes as the value for that field. You can use this any time you have a consistent format for the pairs.
I had a customer example where the field was in brackets followed by the value: