extractkv search command

This search command extracts name=value pairs from raw event data depending on the delimiters specified. By default, name=value pairs are automatically extracted by the product, assuming the equals sign (=) as the separator. But when you run this command, name=value pairs are extracted depending on the options specified (kvdelim and pairdelim). Specifying these options is optional.

You can use this command to extract name=value pairs using other delimiters. A delimiter can be any character by which you extract name=value pairs (kvdelim) and name=value pair sets (pairdelim). You can use multiple characters as delimiters for extracting name=value pairs and name=value pair sets.

If you specify an option without its value, then by default a space ( ) is assumed as the delimiter for extracting name=value pair sets and the equals sign (=) is assumed as the delimiter for extracting name=value pairs. You can optionally limit the number of name=value pair sets to be extracted by using the limit parameter (the default is 50).

Syntax

In the preceding syntax, the following definitions apply:

• [Expression] indicates it is optional.
• pairdelim="<Delimiters>" indicates the option for specifying the delimiters that separate name=value pair sets.
• kvdelim="<Delimiters>" indicates the option for specifying the delimiters that separate name=value pairs.
• limit=<int> indicates the integer value to use for limiting the number of name=value pairs and name=value pair sets.

Short examples

Example 1: Extract name=value pairs where the name=value pair delimiter and name=value pair sets delimiter are set to default.

Example 2: Extract name=value pair sets separated by pipe and semi-colon (|;), where the delimiter for pairdelim (name=value pair sets) and limit options are set to default.

Example 3: Extract name=value pairs separated by colon (:), where the delimiter for kvdelim option (name=value pairs) is set to default.

Example 4: Extract a maximum of ten name=value pairs where the delimiter for kvdelim (name=value pairs) and the delimiter for pairdelim (name=value pair sets) are set to default.

Example 5: Extract name=value pairs separated by colon and equals sign (:=) and name=value pair sets separated by comma and semi-colon (,;).

Long examples

The following sample data and sample indexed data (displayed on the Search tab) will help you understand the examples of using the extractkv command. 

• Sample data
•  
• Sample indexed data
• extractkv with default values
•  
• pairdelim
•  
• kvdelim
•  
• pairdelim and kvdelim
•  
• kvdelim and limit
•  
• pairdelim and kvdelim with multiple values and limit
•  
• pairdelim and kvdelim with multiple values
•  

Sample data

Back to examples ↑

Sample indexed data

Back to examples ↑

extractkv with default values

In this example, you use the command to extract:

• name=value pairs separated by equals sign (=)
• name=value pair sets separated by space ( )

Command

Output

Back to examples ↑

pairdelim

In this example, you use the command to extract name=value pair sets separated by semicolon (;)

Command

Output

Back to examples ↑

kvdelim

In this example, you use the command to extract name=value pairs separated by colon (:)

Command

Output

Back to examples ↑

pairdelim and kvdelim

In this example, you use the command to extract:

• name=value pair sets separated by semicolon (;)
• name=value pairs separated by colon (:)

Command

Output

Back to examples ↑

kvdelim and limit

In this example, you use the command to extract a maximum of two name=value pairs separated by either colon (:) or equals sign (=)

Command

Output

Back to examples ↑

pairdelim and kvdelim with multiple values and limit

In this example, you use the command to extract:

• maximum of two name=value pair sets separated by either comma (,) or semicolon (;)
• maximum of two name=value pairs separated by either colon (:) or equals sign (=)

Command

Output

Back to examples ↑

pairdelim and kvdelim with multiple values

In this example, you use the command to extract:

• name=value pair sets separated by either comma (,) or semicolon (;)
• name=value pairs separated by either colon (:) or equals sign (=)

Command

Output

Back to examples ↑