Related Answers
Download topic as PDF
extract
Description
Extracts field-value pairs from the search results. The extract command works only on the _raw field. If you want to extract from another field, you must perform some field renaming before you run the extract command.
Syntax
extract [<extract-options>... ] [<extractor-name>...]
Required arguments
None.
Optional arguments
- <extract-options>
- Syntax: clean_keys=<bool> | kvdelim=<string> | limit=<int> | maxchars=<int> | mv_add=<bool> | pairdelim=<string> | reload=<bool> | segment=<bool>
- Description: Options for defining the extraction. See the Extract_options section in this topic.
- <extractor-name>
- Syntax: <string>
- Description: A stanza in the
transforms.conffile. This is used when theprops.conffile does not explicitly cause an extraction for this source, sourcetype, or host.
Extract options
- clean_keys
- Syntax: clean_keys=<bool>
- Description: Specifies whether to clean keys. Overrides CLEAN_KEYS in the
transforms.conffile. - Default: The value specified in the CLEAN_KEYS in the
transforms.conffile.
- kvdelim
- Syntax: kvdelim=<string>
- Description: A list of character delimiters that separate the key from the value.
- limit
- Syntax: limit=<int>
- Description: Specifies how many automatic key-value pairs to extract.
- Default: 50
- maxchars
- Syntax: maxchars=<int>
- Description: Specifies how many characters to look into the event.
- Default: 10240
- mv_add
- Syntax: mv_add=<bool>
- Description: Specifies whether to create multivalued fields. Overrides the value for the MV_ADD parameter in the
transforms.conffile. - Default: false
- pairdelim
- Syntax: pair=<string>
- Description: A list of character delimiters that separate the key-value pairs from each other.
- reload
- Syntax: reload=<bool>
- Description: Specifies whether to force reloading of the
props.confandtransforms.conffiles. - Default: false
- segment
- Syntax: segment=<bool>
- Description: Specifies whether to note the locations of the key-value pairs with the results.
- Default: false
Usage
The extract command is a distributable streaming command. See Command types.
Alias
The alias for the extract command is kv.
Examples
1. Specify the delimiters to use for the field and value extractions
Extract field-value pairs that are delimited by the pipe or semicolon characters ( |; ). Extract values of the fields that are delimited by the equal or colon characters ( =: ). The delimiters are individual characters. In this example the "=" or ":" character is used to delimit the key value. Similarly, a "|" or ";" is used to delimit the field-value pair itself.
... | extract pairdelim="|;", kvdelim="=:"
2. Extract field-value pairs and reload the field extraction settings
Extract field-value pairs and reload field extraction settings from disk.
... | extract reload=true
3. Rename a field to _raw to extract from that field
Rename the _raw field to a temporary name. Rename the field you want to extract from, to _raw. In this example the field name is uri_query.
... | rename _raw AS temp uri_query AS _raw | extract pairdelim="?&" kvdelim="=" | rename _raw AS uri_query temp AS _raw
4. Extract field-value pairs from a stanza in the transforms.conf file
Extract field-value pairs that are defined in the stanza 'access-extractions' in the transforms.conf file.
... | extract access-extractions
See also
kvform, multikv, rex, spath, xmlkv, xpath
Answers
Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the extract command.
|
PREVIOUS eventstats |
NEXT fieldformat |
This documentation applies to the following versions of Splunk® Enterprise: 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11, 6.5.0, 6.5.1, 6.5.1612 (Splunk Cloud only), 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.5.10, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.9, 6.6.10, 6.6.11, 6.6.12, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 8.0.0, 8.0.1
Comments
I burned so many hours trying to get this to work because the documentation NEVER mentions that this command only works on the _raw field. Here are the optimal fixes:
1) Add a field argument to this command where we can specify which field we want to extract from
2) Update the documentation in the mean time to state that it only works against the _raw field
3) Provide a work around in the documentation of: | rename _raw as temp FieldToParse as _raw
Hi TonyLeeVT
Back in May when you posted this comment I updated the documentation to:
1. Mention that this only works on the _raw field
2. To provide a work around (see Example 3).
In addition I filed a request to add the enhancement you suggested - the ability to specify a field.
I neglected to add a comment HERE that I had done these things :-(
Rectifying that now :-)