Splunk Search

how to extract payload data (key,value) into table

ramki1459
Explorer

i have data something like this

input:

 

firstname=value1,lastname=value2,email=value3,address=value4.. etc 
firstname=value11,lastname=value12,email=value13,address=value14.. etc 
firstname=value12,lastname=value13,email=value14,address=value15.. etc 

 

output:

 

firstname lastname email address
value1    value2, value3, value4
value11   value12, value13, value14
value12   value13, value14, value15

 

i want to extract this data into a table with keys as column headers. Please note these keys are dynamic and it can have any names.

i tried   

 

search | extract pairdelim="," kvdelim="="

 


but not sure how to put them into a table format. any inputs?

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| table *
0 Karma

ramki1459
Explorer

thank you.

0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...