Splunk Search

How do you do an automatic extraction based on the SPL 'extract' command?

pkeller
Contributor

Using:

index=default sourcetype=my:sourcetype
| extract pairdelim="][", kvdelim="=", auto=f

  Feb 19 09:44:02 foobar Feb 19 2019 09:44:02.322 UTC :  [My Port=2000][Device name=MyDevice][Device IP address=10.3.36.10][Device type=11]

Splunk extracts fields named:

My_Port, Device_name, Device_IP_Address, Device_type

Is there a props extract that will do the same as an automatic extraction, when there will be many unique kv pairs in events with this sourcetype?

Tags (3)
0 Karma
1 Solution

chrisyounger
SplunkTrust
SplunkTrust

Hi @pkeller

You can use this regular expression to do the same thing:

props.conf

[extract_square_pairs]
REGEX  =  \[(?<_KEY_1>[^=\]]+)=(?<_VAL_1>[^\]]+)\]

all then call extract_square_pairs from your props.conf

[SOURCETYPE]
REPORT-extract_square_pairs = extract_square_pairs
KV_MODE = none

Hope this helps!

View solution in original post

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Hi @pkeller

You can use this regular expression to do the same thing:

props.conf

[extract_square_pairs]
REGEX  =  \[(?<_KEY_1>[^=\]]+)=(?<_VAL_1>[^\]]+)\]

all then call extract_square_pairs from your props.conf

[SOURCETYPE]
REPORT-extract_square_pairs = extract_square_pairs
KV_MODE = none

Hope this helps!

0 Karma

pkeller
Contributor

Yes! It helped. Perfectly communicated, and works so well.
Thank you!

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...