
extract
Description
Extracts field-value pairs from the search results.
Syntax
extract [<extract-options>... ] [<extractor-name>...]
Required arguments
None.
Optional arguments
- <extract-options>
- Syntax: clean_keys=<bool> | kvdelim=<string> | limit=<int> | maxchars=<int> | mv_add=<bool> | pairdelim=<string> | reload=<bool> | segment=<bool>
- Description: Options for defining the extraction. See the Extract_options section in this topic.
- <extractor-name>
- Syntax: <string>
- Description: A stanza in the
transforms.conf
file. This is used when theprops.conf
file does not explicitly cause an extraction for this source, sourcetype, or host.
Extract options
- clean_keys
- Syntax: clean_keys=<bool>
- Description: Specifies whether to clean keys. Overrides CLEAN_KEYS in the
transforms.conf
file. - Default: The value specified in the CLEAN_KEYS in the
transforms.conf
file.
- kvdelim
- Syntax: kvdelim=<string>
- Description: A list of character delimiters that separate the key from the value.
- limit
- Syntax: limit=<int>
- Description: Specifies how many automatic key-value pairs to extract.
- Default: 50
- maxchars
- Syntax: maxchars=<int>
- Description: Specifies how many characters to look into the event.
- Default: 10240
- mv_add
- Syntax: mv_add=<bool>
- Description: Specifies whether to create multivalued fields. Overrides the value for the MV_ADD parameter in the
transforms.conf
file. - Default: false
- pairdelim
- Syntax: pair=<string>
- Description: A list of character delimiters that separate the key-value pairs from each other.
- reload
- Syntax: reload=<bool>
- Description: Specifies whether to force reloading of the
props.conf
andtransforms.conf
files. - Default: false
- segment
- Syntax: segment=<bool>
- Description: Specifies whether to note the locations of the key-value pairs with the results.
- Default: false
Usage
The extract
command is a distributable streaming command.
Alias
The alias for the extract
command is kv
.
Examples
Example 1:
Extract field-value pairs that are delimited by the pipe or semicolon characters ( |; ). Extract values of the fields that are delimited by the equal or colon characters ( =: ). The delimiters are individual characters. In this example the "=" or ":" character is used to delimit the key value. Similarly, a "|" or ";" is used to delimit the field-value pair itself.
... | extract pairdelim="|;", kvdelim="=:"
Example 2:
Extract field-value pairs and reload field extraction settings from disk.
... | extract reload=true
Example 3:
Extract field-value pairs that are defined in the stanza 'access-extractions' in the transforms.conf
file.
... | extract access-extractions
See also
kvform, multikv, rex, spath, xmlkv, xpath
Answers
Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the extract command.
PREVIOUS eventstats |
NEXT fieldformat |
This documentation applies to the following versions of Splunk Cloud™: 7.2.4, 7.2.6
Feedback submitted, thanks!