Splunk Search

Extracting kv pars from a field in a json string

brent_weaver
Builder

I have a field in my JSON string like:

message: caas_tcp_est=12326 caas_bgp_est=0 caas_ovpn_elapsed=2288881 caas_ovpn_count=12318 caas_ovpn_memrss=7562140 mem_total=15657072 mem_free=5400856 mem_avail=7519920 cpu_util=3.43

How do I extract that iinto kvpairs? I see the extract command but dont understand know how it works.

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The extract command works in two ways to parse data. One is to invoke a transform defined in your transforms.conf file. The other uses in-line arguments to specify how KV pairs should be parsed. You'll likely want to use the second method. Try this. It tells the extract command that keys are separated from their values by an equals sign and each KV pair is separated by a space.

... | extract kvdelim="=" pairdelim=" " | ...
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...