Thank you so much , it worked ! ... View more

I would likely do this at search time in props & transforms, but I'm not sure if that something you're familiar with? props.conf [your:sourcetype] REPORT-my_aws_fields = my_aws_fields transforms.conf [my_aws_fields] REGEX = "Value":\s*"([^"]+)",\s*"Key":\s*"aws:cloudformation:([^"]+) FORMAT = $2::$1 You should be able plug the regex into regex101 to see what it's doing, but essentially it's capturing each of the Value/Key pairs in your data. For each, it captures the entire value to the first group and then just the part after aws:cloudformation: in the key to the second group. And then we tell splunk to create a field whose name is the second capture group and whose value is the first capture group. So the end result should be those fields with those values. And more generically, any aws:cloudformation:* keys with their values. ... View more

hello there try this out: ... your search ... NOT [ |inputlookup approved_s3_buckets.csv | fields approved_s3_buckets.csv | dedup approved_s3_buckets.csv | table approved_s3_buckets.csv] for practice, try the following searches: first, create a small fruit basket lookup: | makeresults count=1 | eval fruits = "apple,banana,orange,lemon" | makemv delim="," fruits | mvexpand fruits | outputlookup fruits.csv then check its there: | inputlookup fruits.csv then add 2 extra fruits to the basket and verify they arent there: | makeresults count=1 | eval fruits = "apple,banana,orange,lemon,melon,watermelon" | makemv delim="," fruits | mvexpand fruits | search fruits = * NOT [| inputlookup fruits.csv | fields fruits | dedup fruits | table fruits ] hope it helps ... View more

Hi Give a try | makeresults | eval Custom_Tag ="\"Key\": \"Account\", \"Value\": \"037395386785\"" | append [| makeresults | eval Custom_Tag ="\"Key\": \"AssetOwner\", \"Value\": \"Infrastructure\""] | append [| makeresults | eval Custom_Tag ="\"Key\": \"AssetDataStored\", \"Value\": \"InternalUseOnly\""] | append [| makeresults | eval Custom_Tag ="\"Key\": \"Account\", \"Value\": \"343254354354\""] | append [| makeresults | eval Custom_Tag ="\"Key\": \"AssetOwner\", \"Value\": \"Production\""] | append [| makeresults | eval Custom_Tag ="\"Key\": \"AssetDataStored\", \"Value\": \"ExternalUse\""] | eval temp = replace(Custom_Tag , "\"|:|Key|Value","") | makemv delim="," temp | eval column1 = ltrim(mvindex(temp,0)) | eval column2=ltrim(mvindex(temp,1)) | eval{column1}=column2 | stats list(Account) as Tag_Account,list(AssetDataStored) as Tag_AssetDataStored,list(AssetOwner) as Tag_AssetOwner ... View more

I have tested and is not working 😞 . I have other columns not only those 2 and i need the other columns to remain unchanged. I need only tag-key to be parsed as column name , and tag-name to be the value for the columns. ... View more