Below is an example of my event:
Timestamp="05/18/14 11:25:16 AM PDT" SessionIndex="2" Action="STATSDAILY" Version="2.1.10" Platform="Android" Device="HTC One" Params="{coinsEarned : 1800,coinsSpent : 1100,experienceEarned : 2460,timeSpent : 4417,diamondsEarned : 3,diamondsSpent : 18,noOfSessions : 4,energySpent : 7,gamesCompleted : 5}"
In the above event, in the field "Params", I need to extract the keys as the fields and their values as values for the new fields. So a new field "coinsEarned" should be extracted and its value should be "1800" for this event. Similarly for all the key-value pairs in the field Params.
Can someone help me with the regular expression to get the desired results?
You can just add this to your search:
| extract pairdelim="\"{,}" kvdelim=":"
Here is what worked for me:
| makemv tokenizer="([^,]+)," Params | mvexpand line
| rex field=Params "(?<key>[^{:]+) : (?<value>[0-9]+)"
You can just add this to your search:
| extract pairdelim="\"{,}" kvdelim=":"
I used the following to help with this at search time with key-value pairs that had space delimiters and = key delimiters:
| extract pairdelim=" " kvdelim="="
This also works when your KV pairs optionally have quotation marks for data that contains whitespace.
As a matter of fact, one actually doesn't need to specify the field name, which contains all the key value pair.
I used following simple extract parameters:
| extract pairdelim="," kvdelim=":"
One doesn't need to escape "," as done in the first answer!
How to extract something like all the key-value pairs in the field Params ?
Timestamp="05/18/14 11:25:16 AM PDT" SessionIndex="2" Action="STATSDAILY" Version="2.1.10" Platform="Android" Device="HTC One" Params={"coinsEarned":"1800","coinsSpent":"no coins spent","experienceEarned":"2460","timeSpent":"4417","}
I've tried this but no luck
...| extract pairdelim="\"{,}" kvdelim=":"
Thank in advance
I have a similar situation and this answer doesn't work for me. How does the extract
command know to work on the Params
field? It's not mentioned anywhere
Perfect! You saved my day 🙂