Activity Feed
- Karma Re: Building KV Pairs for Andrew_Banman. 06-05-2020 12:46 AM
- Posted Re: can extract pairdelim be limited to a single field? on Splunk Search. 12-02-2015 01:46 PM
- Posted Re: How to get a sourcetype of JSON mixed with text that uses the timestamp within the JSON object and correctly extracts kv and JSON kv pairs? on Splunk Search. 12-01-2015 07:09 AM
Topics I've Started
No posts to display.
12-02-2015
01:46 PM
You can override _raw and wipe out the old fields
... | rename empty as _raw | rename _raw as yourfield | extract pairdelim="[\r\n]+" kvdelim=":"
a little more complicated is to keep the origraw and replace at end
... | eval origraw = _raw | rename empty as _raw | rename _raw as yourfield | extract pairdelim="[\r\n]+" kvdelim=":" | rename origraw as _raw
... View more
12-01-2015
07:09 AM
I downvoted this post because dosnt answer the question
... View more