topic Re: Fields with spaces in Getting Data In

Fields with spaces

techsup — Mon, 28 Sep 2020 13:01:14 GMT

Hello,

I've got a problem with 2008 eventlogs returns by universal forwarder.
My win 2008 R2 is a french version and Fields which extract by Splunk contains spaces and they are not be used.

Splunk 4.3.5

Ex :

...

OpCode=Informations

RecordNumber=45957

Keywords=Échec de l’audit

Message=Échec d’ouverture de session d’un compte.

Sujet : 

ID de sécurité :  AUTORITE NT\Système

Nom du compte :     MIB2011081$

...

No problem with 'OpCode' but 'Nom du compte' isn't usable yet appears in interesting fields.
With a Win2003 eventlog, no problem, 'Nom du compte' is automatically replace by 'Nom_du_compte' in interesting fields.

Any ideas ?

Thanks

Re: Fields with spaces

yannK — Sun, 30 Dec 2012 05:03:31 GMT

A workaround may be to create a field extraction for this specific field.

example with an inline field extraction :

| rex "Nom du compte :\s(?<Nom_du_compte>\w+)"

see http://docs.splunk.com/Documentation/Splunk/5.0/Knowledge/Addfieldsatsearchtime

Re: Fields with spaces

techsup — Wed, 02 Jan 2013 09:16:03 GMT

Thanks, finally that's what I do.

Re: Fields with spaces

ambemou — Tue, 06 Aug 2013 11:54:26 GMT

Hello,

I have a same issue on my splunk 5.0.4 with windows 2008 R2 french can you tell me how you solve this issue.

Thanks

Re: Fields with spaces

sihamUfp — Mon, 25 May 2015 11:27:39 GMT

can you expline how to use rex in this example please