Splunk Search

Searching logfile unrecognised key value pairs

smudge797
Path Finder

Whats the best way to search on the fields within a log that are not automatically recognised as key value pair?

So if i wanted to search on UniqueRequestGUID & XPID values (and display results in a table) below:

2014-06-26T04:56:31.105-07:00 - INFO
RequestType:SFPRe
UniqueRequestGUID:c17d9d1e-9cf8-4866-a166-bc5b4c96374a
ProductType:0
XPID:1
EPID:0
ProductCode:
YGDB_Conn:0
YGDB_RequestDuration:9
Payment:false

Tags (3)
0 Karma

somesoni2
Revered Legend

Try this

props.conf

[YourSourceType]
REPORT-requestfields = transform_requests

transforms.conf

[transform_requests]
DELIMS = "\n", ":"
CLEAN_KEYS = true
0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...