If you are using Oracle Unified Audit (starting with Oracle 12c R1), you can use the following Oracle Unified Audit App for Splunk https://splunkbase.splunk.com/app/6172/  best regards Altin ... View more

Hi joshd, when you talk about flat file, do you mean syslog flat file or standard ".aud" oracle file? ... View more

Splunk for Oracle Audit Trails is available. Download from: http://splunk-base.splunk.com/apps/36943/oracle-audit-trail ... View more

You can extract the key/value pair with one extraction: (?i)(?<_KEY_1>\S+):\s+"(?<_VAL_1>[^"]+)" This will result these fields and values from you log: SESSIONID=21288516 ENTRYID=5158831 STATEMENT=3585703 USERID=TEST ACTION=6 RETURNCODE=0 OBJ_CREATOR=TEST OBJ_NAME=SR_JOB OS_USERID=auditwks Note that Splunk is smart enough to replace the $ char in the field name. ... View more