Splunk Search

Key Value pair extraction with unique value

mayank141
New Member

Hi,

I need to extract unique values as per below sample data

Its has unique format like [ parameter : mailboxName | value : mail\tdev2.nsf], how to extract the data with parameter name and its value?

[2017-11-06]T[16:33:21.122]Z 31 WebContainer : 4 WARNING [ parameter : mailboxName | value : mail\xdevx.xxx];[ parameter : userID | value : CN=Test Dev2/OU=US/O=xxxDEV];[ parameter : OPERATION | value : SEARCH ];[ parameter : session | value : eSbBsoxxxxxx_O9AIxxxxxx ] [com.xxx.xxx.actions.MainAction: execute]

Please advise.

Thanks
Mayank

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi mayank141,

you can use the search time reporting transforms in props.conf and transforms.conf to get this captured:
props.conf

[mySourceType]
REPORT-myUniqueClassName = myTransform

transforms.conf

[myTransform]
REGEX = \[\s\w+\s:\s(\w+)\s\|\s\w+\s:\s([^\]]+)
FORMAT = $1::$2

This will capture the value after parameter : as field name and the value after value : as value of the field.

Hope this helps ...

cheers, MuS

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

Search time or index time field extraction?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...