Getting Data In

Best Sourcetype for KV pair

splunkLPN
Path Finder

1- How to define the KV pair and delimitation in the source type ?

the extract has this form (with 15 KV)
k1="v1", k2="v2", ...

2- What extract form do you recommend (JSON ?)

3- is
| extract pairdelim=", " kvdelim="="

as fast as define that in the source type ?

thks for your help 🙂

0 Karma

sundareshr
Legend

The difference between using extract during in your search and setting up search time extraction is with search time extraction, the fields are available for using without having to extract them every time. Also allows you to create aliases etc. With the extract command, you will have to repeat the extraction with every search.

To enable to search time extraction, you will need to make the following changes

*Transforms*

    [kv_pair_delim]
    DELIMS = ",", "="

*Props*
[your sourcetype stanza]
REPORT-activity = kv_pair_delim

0 Karma

woodcock
Esteemed Legend

You need to provide more detail and better text. What exactly are you trying to do and what do your raw events look like (show a few samples)?

It looks like you are asking 2 questions. If you have raw events in the form listed in 1 above, then you should be able to use the extract that you provided in 3. As far as 2, perhaps you are asking if you should convert the source data into JSON instead of KVP. I would say Yes because KVP is only a little smaller than JSON and JSON will probably be more efficient to digest. If you have the ability to modify the source events, though, I highly recommend going to CSV with a header line, instead.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...