topic Re: Index time field extraction problem with space in Getting Data In

Index time field extraction problem with space

sigma — Mon, 28 Jul 2025 17:58:08 GMT

Hi all,

I want to extract fields from a custom log format. Here's my transforms.conf:

REGEX = ^\w+\s+\d+\s+\d+:\d+:\d+\s+\d{1,3}(?:\.\d{1,3}){3}\s+\d+\s+\S+\s+(\S+)(?:\s+(iLO\d+))?\s+-\s+-\s+-\s+(.*) FORMAT = name::$1 version::$2 message::$3 DEST_KEY = _meta

This regex is supposed to extract the following from a log like:

Jul 27 14:10:05 1.2.3.4 1 2025-07-27T14:09:05Z QQQ123-G12-W4-AB iLO6 - - - iLO time update failed. Unable to contact NTP server.

Expected extracted fields:

name = QQQ123-G12-W4-AB
version = iLO6
message = iLO time update failed. Unable to contact NTP server.

The regex works correctly when tested independently, and all three groups are matched. However, in Splunk, only the first two fields (name and version) are extracted correctly. The message field only includes the first word: iLO.

It seems Splunk is stopping at the first space for the message field, despite the regex using (.*) at the end. Any idea what could be causing this behavior?
Is there a setting or context where Splunk treats fields as single-token values by default?
Any advice would be appreciated!

Re: Index time field extraction problem with space

livehybrid — Tue, 29 Jul 2025 06:45:17 GMT

Hi @sigma

The first thing you could try is adding a $ to the end of the REGEX so that the match is forced to run to the end of the line.

Secondly, are there any other extractions that could be overlapping with this? Its just good to rule out the affects of other props.conf on your work!

Also, instead of DEST_KEY=_meta you could try WRITE_META=true like below, although I dont think this would affect your extraction here:

REGEX = ^\w+\s+\d+\s+\d+:\d+:\d+\s+\d{1,3}(?:\.\d{1,3}){3}\s+\d+\s+\S+\s+(\S+)(?:\s+(iLO\d+))?\s+-\s+-\s+-\s+(.*)$ FORMAT = name::$1 version::$2 message::$3 WRITE_META = true

Have you defined your fields.conf for the indexed fields?

Add an entry to fields.conf for the new indexed field:

# fields.conf [<your_custom_field_name>] INDEXED=true

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Index time field extraction problem with space

PickleRick — Tue, 29 Jul 2025 16:53:14 GMT

Why would you create indexed fields in the first place? You have a nice space-delimited entries, if you just want performance, use TERM() in your searches.