Splunk Search

extract command

splunkn
Communicator

Hi,

This is sample event. I tried to explore extract command.

index=* sourcetype=orange | extract pairdelim=";", kvdelim=":"

4/18/161:00:00.000 PM 2016-04-18 13:00:00 user:hgfh;std:6;status:success

For the above event its only extracted std as 6 and status as success but not the user. Why is that like. So is it expecting ";" before and after?

And cant we use kvdelim alone in our queries?
index=* sourcetype=orange | extract kvdelim=":"

Thanks

Tags (2)
1 Solution

tormodbp
Path Finder

Try specifying space-character as a pair delimiter as well.

index=* sourcetype=orange | extract pairdelim="; " kvdelim=":"

For me that gave the correct and expected result.

user:hgfh
std:6
status:success

I suspect that since the kv extract is "mid-sentence" it tries to outrule anything that does not fit exactly with the specified pair delimiter. Thus resulting in the return of only two kv-pairs unless you specify space and semicolon as pair delimiters.

Cheers,

View solution in original post

tormodbp
Path Finder

Try specifying space-character as a pair delimiter as well.

index=* sourcetype=orange | extract pairdelim="; " kvdelim=":"

For me that gave the correct and expected result.

user:hgfh
std:6
status:success

I suspect that since the kv extract is "mid-sentence" it tries to outrule anything that does not fit exactly with the specified pair delimiter. Thus resulting in the return of only two kv-pairs unless you specify space and semicolon as pair delimiters.

Cheers,

splunkn
Communicator

Thanks tomodbp. Its worked !! aren't we able to use kvdelim alone?

0 Karma

tormodbp
Path Finder

No problem!
I would think that you should be able to, but I am unable to find any documentation to support that claim. I've tried to experiment with the parameters. So far I have not found any other solution using ´kv´ / ´extract´, sorry.

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...