Splunk Search

How do you do an automatic extraction based on the SPL 'extract' command?

pkeller
Contributor

Using:

index=default sourcetype=my:sourcetype
| extract pairdelim="][", kvdelim="=", auto=f

  Feb 19 09:44:02 foobar Feb 19 2019 09:44:02.322 UTC :  [My Port=2000][Device name=MyDevice][Device IP address=10.3.36.10][Device type=11]

Splunk extracts fields named:

My_Port, Device_name, Device_IP_Address, Device_type

Is there a props extract that will do the same as an automatic extraction, when there will be many unique kv pairs in events with this sourcetype?

Tags (3)
0 Karma
1 Solution

chrisyounger
SplunkTrust
SplunkTrust

Hi @pkeller

You can use this regular expression to do the same thing:

props.conf

[extract_square_pairs]
REGEX  =  \[(?<_KEY_1>[^=\]]+)=(?<_VAL_1>[^\]]+)\]

all then call extract_square_pairs from your props.conf

[SOURCETYPE]
REPORT-extract_square_pairs = extract_square_pairs
KV_MODE = none

Hope this helps!

View solution in original post

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Hi @pkeller

You can use this regular expression to do the same thing:

props.conf

[extract_square_pairs]
REGEX  =  \[(?<_KEY_1>[^=\]]+)=(?<_VAL_1>[^\]]+)\]

all then call extract_square_pairs from your props.conf

[SOURCETYPE]
REPORT-extract_square_pairs = extract_square_pairs
KV_MODE = none

Hope this helps!

0 Karma

pkeller
Contributor

Yes! It helped. Perfectly communicated, and works so well.
Thank you!

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...