Splunk Search

extract command

splunkn
Communicator

Hi,

This is sample event. I tried to explore extract command.

index=* sourcetype=orange | extract pairdelim=";", kvdelim=":"

4/18/161:00:00.000 PM 2016-04-18 13:00:00 user:hgfh;std:6;status:success

For the above event its only extracted std as 6 and status as success but not the user. Why is that like. So is it expecting ";" before and after?

And cant we use kvdelim alone in our queries?
index=* sourcetype=orange | extract kvdelim=":"

Thanks

Tags (2)
1 Solution

tormodbp
Path Finder

Try specifying space-character as a pair delimiter as well.

index=* sourcetype=orange | extract pairdelim="; " kvdelim=":"

For me that gave the correct and expected result.

user:hgfh
std:6
status:success

I suspect that since the kv extract is "mid-sentence" it tries to outrule anything that does not fit exactly with the specified pair delimiter. Thus resulting in the return of only two kv-pairs unless you specify space and semicolon as pair delimiters.

Cheers,

View solution in original post

tormodbp
Path Finder

Try specifying space-character as a pair delimiter as well.

index=* sourcetype=orange | extract pairdelim="; " kvdelim=":"

For me that gave the correct and expected result.

user:hgfh
std:6
status:success

I suspect that since the kv extract is "mid-sentence" it tries to outrule anything that does not fit exactly with the specified pair delimiter. Thus resulting in the return of only two kv-pairs unless you specify space and semicolon as pair delimiters.

Cheers,

splunkn
Communicator

Thanks tomodbp. Its worked !! aren't we able to use kvdelim alone?

0 Karma

tormodbp
Path Finder

No problem!
I would think that you should be able to, but I am unable to find any documentation to support that claim. I've tried to experiment with the parameters. So far I have not found any other solution using ´kv´ / ´extract´, sorry.

0 Karma
Get Updates on the Splunk Community!

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...