Splunk Search

How to extract value using KV pairs?

hraj05579
New Member

Hello all,

How I can extra value from my event?

23-Oct-2019 08:07:23 <TestCase1>23</TestCase1>
23-Oct-2019 08:07:23    <TestCasePassed>234</TestCasePassed>

I want to display TestCase1= 23 TestCasePassed=234

Thanks in advance.

0 Karma

woodcock
Esteemed Legend

Like this:

|makeresults | eval raw=" 23-Oct-2019 08:07:23 <TestCase1>23</TestCase1>:::23-Oct-2019 08:07:23 <TestCasePassed>234</TestCasePassed>"
| makemv delim=":::" raw
| mvexpand raw
| rename raw AS _raw

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution."

| rex max_match=20 "<(?<key>[^\/][^>]+)>(?<value>.*?)<\/[^>]+>"
| eval _raw=mvzip(key, value, "=")
| kv
0 Karma

to4kawa
Ultra Champion
| makeresults
| eval raw="23-Oct-2019 08:07:23 <TestCase1>23</TestCase1>
23-Oct-2019 08:07:23    <TestCasePassed>234</TestCasePassed>"
| makemv delim="
" raw
| mvexpand raw
| rex field=raw "(?<time>^[^ ]+ [^ ]+) (?<_raw>.+)"
| eval _time=strptime(time,"%d-%b-%Y %H:%M:%S")
| table _time _raw
`comment("this is sample data")`
| spath

Hi, try spath command

0 Karma
Get Updates on the Splunk Community!

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...