Splunk Search

How do you do an automatic extraction based on the SPL 'extract' command?

pkeller
Contributor

Using:

index=default sourcetype=my:sourcetype
| extract pairdelim="][", kvdelim="=", auto=f

  Feb 19 09:44:02 foobar Feb 19 2019 09:44:02.322 UTC :  [My Port=2000][Device name=MyDevice][Device IP address=10.3.36.10][Device type=11]

Splunk extracts fields named:

My_Port, Device_name, Device_IP_Address, Device_type

Is there a props extract that will do the same as an automatic extraction, when there will be many unique kv pairs in events with this sourcetype?

Tags (3)
0 Karma
1 Solution

chrisyounger
SplunkTrust
SplunkTrust

Hi @pkeller

You can use this regular expression to do the same thing:

props.conf

[extract_square_pairs]
REGEX  =  \[(?<_KEY_1>[^=\]]+)=(?<_VAL_1>[^\]]+)\]

all then call extract_square_pairs from your props.conf

[SOURCETYPE]
REPORT-extract_square_pairs = extract_square_pairs
KV_MODE = none

Hope this helps!

View solution in original post

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Hi @pkeller

You can use this regular expression to do the same thing:

props.conf

[extract_square_pairs]
REGEX  =  \[(?<_KEY_1>[^=\]]+)=(?<_VAL_1>[^\]]+)\]

all then call extract_square_pairs from your props.conf

[SOURCETYPE]
REPORT-extract_square_pairs = extract_square_pairs
KV_MODE = none

Hope this helps!

0 Karma

pkeller
Contributor

Yes! It helped. Perfectly communicated, and works so well.
Thank you!

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...