SPL to extract field and field value?

[AK_Splunk]

SPL to extract field and field value when data seems like below

screenshot attached.
I need help in extracting field as memUsedPct which should hold the value as 82,3.
 

[AK_Splunk]

Thanks for your quick response.

| multikv forceheader=1

The multikv command isnt helping much.Currently I am getting balnk in the memUsedPct.

I need to extract only memUsedPct as 17,7.

[yuanliu]

You need to demonstrate your data, in text form. (Anonymize as needed, but maintain format.)  How does a _raw event look like?

[yuanliu]

Using screenshots to illustrate complex data is a terrible method.  Try using text.

This said, are you suggesting that you have input with CSV format?  One way to handle them is to use multikv.  Assuming that data is already in _raw:

| multikv forceheader=1

If it is that in _raw, but in a field called CSV_data, swap it with _raw,

| rename _raw as temp, CSV_data as _raw
| multikv forceheader=1
| rename temp as _raw ``` assume that you no longer care about CSV_data ```