Splunk Search

Can extract or kv command be limited to a specific field?

recurse
New Member

It seems the extract/kv command uses _raw as input to do its parsing. Is there any way to pass a previously extracted field to it instead?

Given this sample event:

| stats count
| eval _raw="messageToParse=\"key1:val1,key2:val2,key3:val3\" user=\"user123\" application=\"app123\" host=\"host123\""

I'm looking for something similar to:

| extract kvdelim=":" pairdelim="," input=messageToParse

to produce a table of:

key1    |    key2    |    key3
val1    |    val2    |    val3

Note: The number of kvps in messageToParse is greater than 50, so parsing them individually via regex is not suitable.

Any ideas?

Tags (4)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

One workaround is this

| gentimes start=-1 | eval _raw="messageToParse=\"key1:val1,key2:val2,key3:val3\" user=\"user123\" application=\"app123\" host=\"host123\"" | table _raw | extract  | rename _raw as temp messageToParse as _raw | extract kvdelim=":=" pairdelim=", " | rename _raw as messageToParse | rename temp as _raw

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

One workaround is this

| gentimes start=-1 | eval _raw="messageToParse=\"key1:val1,key2:val2,key3:val3\" user=\"user123\" application=\"app123\" host=\"host123\"" | table _raw | extract  | rename _raw as temp messageToParse as _raw | extract kvdelim=":=" pairdelim=", " | rename _raw as messageToParse | rename temp as _raw
0 Karma

recurse
New Member

Thanks for the reply - I saw something similar in another post as well I think. The trouble I had was finding a way to limit the results in the table/output to only the keys parsed from messageToParse, instead of including user,application, etc, without manually specifying each key to display.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

If in your final results, you only want to show keys which are included in messageToParse, they try like this

| gentimes start=-1 | eval _raw="messageToParse=\"key1:val1,key2:val2,key3:val3\" user=\"user123\" application=\"app123\" host=\"host123\"" | table _raw | extract  | table messageToParse| rename messageToParse as _raw | extract kvdelim=":=" pairdelim=", " | fields - _raw
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...