Extract fields with search commands
This documentation applies to the following versions of Splunk: 4.0 , 4.0.1 , 4.0.2 , 4.0.3 , 4.0.4 , 4.0.5 , 4.0.6 , 4.0.7 , 4.0.8 , 4.0.9 , 4.0.10
Contents
Extract fields with search commands
As mentioned in "Extract and add new fields", you can use a variety of search commands to extract fields in different ways. Continuing reading for examples of usage for the rex, extract, multikv, xmlkv, and kvform commands.
Extract fields using regular expressions
The rex search command performs field extractions using Perl regular expression named groups that you include in the search string. It matches segments of your raw events with the regular expression and saves these values into a field.
In this example, Splunk matches terms that occur after the strings "From:" and "To:" and saves these values into the "from" and "to" fields, respectively.
... | rex field=_raw "From: (?<from>.*) To: (?<to>.*)"
If a raw event contains "From: Susan To: Bob", then Splunk would extract the field name/value pairs: "from=Susan" and "to=Bob".
For a primer on regular expression syntax and usage, see Regular-Expressions.info. Splunk also maintains a list of useful third-party tools for writing and testing regular expressions.
Force field value extractions on search results
Force field extractions defined in conf files
The extract (or kv, for "key/value") search command forces field/value extraction on the result set. If you use extract without specifying any arguments, Splunk extracts fields using field extraction stanzas that have been added to props.conf. You can use extract to test any field extractions that you add manually through conf files.
Extract fields from events formatted as tables
Use multikv to force field/value extraction on multi-line, tabular-formatted events. It creates a new event for each table row and derives field names from the table title.
Extract fields from events formatted in xml
The xmlkv command enables you to force field/value extraction on xml-formatted event data, such as transactions from webpages.
Extract fields from events based on form templates
The kvform command extracts field/value pairs from events based on form templates that are predefined and stored in $SPLUNK_HOME/etc/system/local/, or your own custom application directory in $SPLUNK_HOME/etc/apps/. For example, if form=sales_order, Splunk would look for a sales_order.form, and Splunk would match all processed events against that form, trying to extract values.