https://community.splunk.com/t5/Splunk-Dev/How-can-you-specify-additional-characters-to-the-indexing/m-p/339633#M5160 <P>We have messages that have tabs replaced with #011 along with other control characters (See rsyslog EscapeControlCharactersOnReceive setting) but we do not want to turn this setting off. Ideally, we want to have Splunk split on #011 in addition to the existing splitting tokens (real tab, spaces, etc). When we have log lines like:</P> <P>#011Testing 123</P> <P>We are unable to search for "Testing" without specifying it as a wildcard or some other substring technique. We would like to be able to search for Testing as if it a log line without the #011 replacement.</P> Fri, 15 Sep 2017 01:56:14 GMT nathansvlsr 2017-09-15T01:56:14Z https://community.splunk.com/t5/Splunk-Dev/How-can-you-specify-additional-characters-to-the-indexing/m-p/339633#M5160 <P>We have messages that have tabs replaced with #011 along with other control characters (See rsyslog EscapeControlCharactersOnReceive setting) but we do not want to turn this setting off. Ideally, we want to have Splunk split on #011 in addition to the existing splitting tokens (real tab, spaces, etc). When we have log lines like:</P> <P>#011Testing 123</P> <P>We are unable to search for "Testing" without specifying it as a wildcard or some other substring technique. We would like to be able to search for Testing as if it a log line without the #011 replacement.</P> Fri, 15 Sep 2017 01:56:14 GMT https://community.splunk.com/t5/Splunk-Dev/How-can-you-specify-additional-characters-to-the-indexing/m-p/339633#M5160 nathansvlsr 2017-09-15T01:56:14Z https://community.splunk.com/t5/Splunk-Dev/How-can-you-specify-additional-characters-to-the-indexing/m-p/339634#M5161 <P>Take a look at $SPLUNK_HOME/etc/system/default/segmentors.conf. You can add your own key/value segmentors by creating that file in ./local/. As always, test, test, test before deploying into production:)</P> <P>You can also check out <A href="http://docs.splunk.com/Documentation/Splunk/latest/admin/Segmentersconf">http://docs.splunk.com/Documentation/Splunk/latest/admin/Segmentersconf</A></P> Fri, 15 Sep 2017 16:00:57 GMT https://community.splunk.com/t5/Splunk-Dev/How-can-you-specify-additional-characters-to-the-indexing/m-p/339634#M5161 sshelly_splunk 2017-09-15T16:00:57Z