extract command

[splunkn]

Hi,

This is sample event. I tried to explore extract command.

index=* sourcetype=orange | extract pairdelim=";", kvdelim=":"

4/18/161:00:00.000 PM 2016-04-18 13:00:00 user:hgfh;std:6;status:success

For the above event its only extracted std as 6 and status as success but not the user. Why is that like. So is it expecting ";" before and after?

And cant we use kvdelim alone in our queries?
index=* sourcetype=orange | extract kvdelim=":"

Thanks

[tormodbp · Accepted solution]

Try specifying space-character as a pair delimiter as well.

index=* sourcetype=orange | extract pairdelim="; " kvdelim=":"

For me that gave the correct and expected result.

user:hgfh
std:6
status:success

I suspect that since the kv extract is "mid-sentence" it tries to outrule anything that does not fit exactly with the specified pair delimiter. Thus resulting in the return of only two kv-pairs unless you specify space and semicolon as pair delimiters.

Cheers,

[splunkn]

Thanks tomodbp. Its worked !! aren't we able to use kvdelim alone?

[tormodbp]

No problem!
I would think that you should be able to, but I am unable to find any documentation to support that claim. I've tried to experiment with the parameters. So far I have not found any other solution using ´kv´ / ´extract´, sorry.