Splunk Search

How to format output table for an object?

alpsplunkuser
Engager

I have a message that consists of key-value pairs:
"status=BLOCKED, identifier=123422dsd13, userId=12344, name=John"
I am using | extract pairdelim=", " kvdelim="=" to extract these key-value pairs.

As an output I would like to get a 2-columns table with rows that contain key in column1 and value in column2:


| Key | Value |
| status | BLOCKED |
| identifier | 123422dsd13 |
| userId | 12344 |
| name | John |

0 Karma
1 Solution

efavreau
Motivator

@alpsplunkuser I didn't need the kvdelim to get it to break into key value pairs in this example, but I don't have your data, so YMMV. I think the command you're looking for is untable. To use it in this run anywhere example below, I added a column I don't care about. Then untable it, to get the columns you want. Then use table to get rid of the column I don't want, leaving exactly what you were looking for.

| noop 
| stats count 
| eval _raw="Whatisthis=donotcare, status=BLOCKED, identifier=123422dsd13, userId=12344, name=John"
| extract pairdelim=", "
| untable Whatisthis Key Value
| table Key Value

https://docs.splunk.com/Documentation/Splunk/Latest/SearchReference/Untable

###

If this reply helps you, an upvote would be appreciated.

View solution in original post

efavreau
Motivator

@alpsplunkuser I didn't need the kvdelim to get it to break into key value pairs in this example, but I don't have your data, so YMMV. I think the command you're looking for is untable. To use it in this run anywhere example below, I added a column I don't care about. Then untable it, to get the columns you want. Then use table to get rid of the column I don't want, leaving exactly what you were looking for.

| noop 
| stats count 
| eval _raw="Whatisthis=donotcare, status=BLOCKED, identifier=123422dsd13, userId=12344, name=John"
| extract pairdelim=", "
| untable Whatisthis Key Value
| table Key Value

https://docs.splunk.com/Documentation/Splunk/Latest/SearchReference/Untable

###

If this reply helps you, an upvote would be appreciated.

DalJeanis
SplunkTrust
SplunkTrust

Try this instead

| rex field=NameOfMessageField max_match=0 "(?<Key>[^=,]+)=(?<Value>[^,]+)[, ]*"

alpsplunkuser
Engager

thanks for the reply, your approach also works to extract key-value pairs, but I am more interested in output format rather than parsing.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...