Splunk Search

Key-Value extraction using rex function

josknigh
Engager

Is it possible to use the rex command to do a dynamic key=value extraction where they key is a also a regular expression?

I know this can be done with a transform using:

REGEX = (,*?)=(.*?)

FORMAT = $1::$2

Can I do the same thing using rex instead? Maybe something like:

rex field=_raw "(?P<\\FIELDNAME>.*?)=(?<\\VALUE>.*?)"

Is their something I'm missing in the group naming syntax?

I'm looking for a way to do this at search-time rather than index-time without writing a transform.

lguinn2
Legend

I don't know how to do this with rex, but have you looked at using the DELIMS key word in transforms.conf? If there is a regular pattern in your data that defines fields

name:value name2:value2

then you can specify that with

DELIMS = " ", ":"

More details re: transforms.conf are here Take a look at the examples at the very end of the page.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...