How to modify field extraction?

balcv — Tue, 24 Nov 2020 05:28:37 GMT

I have a data source that is being ingested into Splunk using a default field extraction which is working fine. The data looks like:

DateTime=2020-11-24-10.38.00.869407,type=New-Request,Username=9999999,Client-Mac=F8-4E-73-xx-xx-xx,Called-Station-Id=A0-D3-C1-zz-zz-zz,SSID=myWiFi,NAS-IP=192.168.141.130,Nas-Identifier=CISCO_AP:CN3AD338P5,NAS-Port-Type=Wireless-802.11,Campus=SMB,Location=SMB Buildings HI

The data is being parsed correctly and I get the field name / value pairs in Splunk no problem (field_name=value). The issue I have is the last field, Location.

The default field extraction is extracting the Location field however if the value contains spaces I am only getting up to the first space as the value in the indexed data. From the above example, my Location data is returning "SMB" only and not "SMB Buildings HI".

Is there any way to resolve this to either prevent it splitting the value at the space, or to replace the space with another character such as '_'.

Re: Modifying Field Extraction

thambisetty — Tue, 24 Nov 2020 05:13:50 GMT

@balcv

share details of TA and it's version to check configuration and to provide you fix.

Re: Modifying Field Extraction

balcv — Tue, 24 Nov 2020 21:14:54 GMT

Thanks for replying @thambisetty , but what is TA?

Re: How to modify field extraction?

to4kawa — Tue, 24 Nov 2020 21:41:36 GMT

props.conf:

SEDCMD-kv = s/=([^,]+)(,|$)/="\1"\2/g

work around:

| rex "Location=(?<Location>[^,]+),|$"

topic Re: Modifying Field Extraction in Splunk Enterprise

How to modify field extraction?

Re: Modifying Field Extraction

Re: Modifying Field Extraction

Re: How to modify field extraction?