Splunk Search

How to use extract kvdelim and pairdelim to parse all key value pairs in my sample data?

reswob4
Builder

We have log entries similar to below and while I can write a regex expression to parse out all the kv pairs separated by a :, I wanted to know if there was a way I could use extract kvdelim to do the same. Note that all the k:v pairs come AFTER the % expression. In this case they also come after the = sign (Some logs do not have the = sign)

Jan 5 18:21:49.817: %VOIPAAA-5-VOIP_FEAT_HISTORY: FEAT_VSA=fn:TWC,ft:01/05/2012 18:21:34.254,cgn:3333,cdn:1023,frs:0,fid:1013,fcid:EDD6080E370011E18A2BC77F1C86C06D,legID:455,bguid:EDD6080E370011E18A2BC77F1C86C06D

I'm trying to do it via the search first before putting it into the transforms.conf so my search currently is

FEAT_HISTORY | extract pairdelim="=%",kvdelim=":"

but that doesn't work, it doesn't extract the k:v pairs in the above. Is there a way I can get the above to work or should I just stick with the long regex expression I've created?

Thanks

ref 1: http://docs.splunk.com/Documentation/Splunk/6.1.4/SearchReference/Extract
ref 2: http://blogs.splunk.com/2008/02/12/delimiter-based-key-value-pair-extraction/

1 Solution

javiergn
SplunkTrust
SplunkTrust

Hi, try this and let me know if helps:

| stats count
| eval _raw = "Jan 5 18:21:49.817: %VOIPAAA-5-VOIP_FEAT_HISTORY: FEAT_VSA=fn:TWC,ft:01/05/2012 18:21:34.254,cgn:3333,cdn:1023,frs:0,fid:1013,fcid:EDD6080E370011E18A2BC77F1C86C06D,legID:455,bguid:EDD6080E370011E18A2BC77F1C86C06D"
| extract kvdelim=":" pairdelim=","

This is the output I'm getting:

FEAT_VSA    fn:TWC
bguid   EDD6080E370011E18A2BC77F1C86C06D
cdn     1023
cgn     3333
fcid    EDD6080E370011E18A2BC77F1C86C06D
fid     1013
frs     0
legID   455 

View solution in original post

javiergn
SplunkTrust
SplunkTrust

Hi, try this and let me know if helps:

| stats count
| eval _raw = "Jan 5 18:21:49.817: %VOIPAAA-5-VOIP_FEAT_HISTORY: FEAT_VSA=fn:TWC,ft:01/05/2012 18:21:34.254,cgn:3333,cdn:1023,frs:0,fid:1013,fcid:EDD6080E370011E18A2BC77F1C86C06D,legID:455,bguid:EDD6080E370011E18A2BC77F1C86C06D"
| extract kvdelim=":" pairdelim=","

This is the output I'm getting:

FEAT_VSA    fn:TWC
bguid   EDD6080E370011E18A2BC77F1C86C06D
cdn     1023
cgn     3333
fcid    EDD6080E370011E18A2BC77F1C86C06D
fid     1013
frs     0
legID   455 

reswob4
Builder

A: That was fast
B: That worked

Thanks

0 Karma

reswob4
Builder

I take it back a little: It worked mostly. It did not extract ft, where the time is stored. probably because there are colons in the middle of that field. I can regex that though.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...