topic Re: Key Value Pairs with Spaces in Getting Data In

Key Value Pairs with Spaces

ezajac — Tue, 22 Jan 2013 15:29:53 GMT

A developer made a change to the logging that they were managing. They added a new Key Value Pair and the results now have spaces ie Operation=Web Service Call: callABCService. Splunk Search is classifying this as Operation=Web. Is there a quick fix that I can make in Transforms or Props to work around this?

Thank you

Re: Key Value Pairs with Spaces

jonuwz — Tue, 22 Jan 2013 21:36:15 GMT

Whats the rest of the raw event look like ?

Re: Key Value Pairs with Spaces

michaelbrunetto — Thu, 21 Feb 2013 03:53:38 GMT

Easiest way is to get the developer to quote their output. So Operation="Web Service Call: callABCService".

I have a similar problem, but with a product I can't change the logging on, so any other advice would be wonderfully helpful.

Re: Key Value Pairs with Spaces

n8 — Tue, 16 Jul 2013 22:51:03 GMT

Is each KV pair on a line by itself? If so you can just do something like the following:

props.conf

REPORT-bad_dev_format = kv-spaces

transforms.conf

[kv-spaces]
DELIMS = "\n","="

Otherwise paste a copy of an event and maybe we can suggest a transforms solution.