Extracts key-value pairs from events based on a form template that describes how to extract the values.
For Splunk Cloud Platform, you must create a private app to extract key-value pairs from events. If you are a Splunk Cloud administrator with experience creating private apps, see Manage private apps in your Splunk Cloud Platform deployment in the Splunk Cloud Admin Manual. If you have not created private apps, contact your Splunk account representative for help with this customization.
kvform [form=<string>] [field=<field>]
- Syntax: form=<string>
- Description: Specify a .form file located in a
- Syntax: field=<field_name>
- Description: Uses the field name to look for
.formfiles that correspond to the field values for that field name. For example, your Splunk deployment uses the
mongodsourcetypes. If you specify
kvformcommand looks for the
- Default: sourcetype
Before you can use the
kvform command, you must:
- Create the
formsdirectory in the appropriate application path. For example
- Create the
.formfiles and add the files to the
Format for the .form files
.form file is essentially a text file of all static parts of a form. It might be interspersed with named references to regular expressions of the type found in the transforms.conf file.
.form file might look like this:
Students Name: [[string:student_name]] Age: [[int:age]] Zip: [[int:zip]]
Specifying a form
form argument is specified, the
kvform command uses the
<form_name>.form file found in the Splunk configuration
forms directory. For example, if
kvform command looks for a
sales_order.form file in the
$SPLUNK_HOME/etc/apps/<app_name>/forms directory for all apps. All the events processed are matched against the form, trying to extract values.
Specifying a field
If you specify the
field argument, the the
kvform command looks for forms in the
forms directory that correspond to the values for that field. For example, if you specify
field=error_code, and an event has the field value
error_code=404, the command looks for a form called
404.form in the
field argument is specified, the
kvform command uses the default value for the
field argument, which is
kvform command looks for
<sourcetype_value>.form files to extract values.
1. Extract values using a specific form
Use a specific form to extract values from.
... | kvform form=sales_order
2. Extract values using a field name
field=sourcetype to extract values from forms such as
mongod.form. If there is a form for a source type, values are extracted from that form. If one of the source types is
access_combined but there is no
access_combined.form file, that source type is ignored.
... | kvform field=sourcetype
3. Extract values using the eventtype field
... | kvform field=eventtype
This documentation applies to the following versions of Splunk® Enterprise: 6.5.7, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.8, 7.1.7, 7.0.0, 7.3.7, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.10, 8.1.11, 8.1.12, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 7.3.9, 8.0.0, 8.0.1