topic Re: Default delimiters for key value extraction in Getting Data In

Default delimiters for key value extraction

helge — Wed, 02 Jul 2014 13:23:22 GMT

I have been sending key value data like the following to Splunk:

metric1=1.0 metric2=22 metric3="Some string"

I have manually wrapped values that may contain spaces in double quotes. I would like to formalize this and write a routine that automatically wraps values in quotes when necessary. To do that I need to know what the default delimiters are. I could not find a list anywhere.

Delimiters between key and value: anything else in addition to the equal sign (=)?

Delimiters between pairs: anything else in addition to the space ( )?

Re: Default delimiters for key value extraction

somesoni2 — Wed, 02 Jul 2014 13:30:00 GMT

Comma is also one of the default delimiters between pairs. If your value contains a comma, it should be in double quotes. See this run anywhere example.

|gentimes start=-1 | eval _raw="First=Example Last=LastName,Email=Example,LastName@gmail.com Email2=\"Example,LastName@gmail.com\"" | table _raw | extract

This should be full list (per my knowledge)

space
comma
semicolon
pipe
ampersand
tab
new line

Re: Default delimiters for key value extraction

martin_mueller — Wed, 02 Jul 2014 13:33:06 GMT

Same story with semicolons, pipes, newlines, tabs, ...

Re: Default delimiters for key value extraction

helge — Wed, 02 Jul 2014 13:52:09 GMT

I am looking for a full list of delimiters.

Re: Default delimiters for key value extraction

gkanapathy — Wed, 02 Jul 2014 14:16:04 GMT

If you're really looking for something cleanly defined, I would not rely on heuristic key-value detection, but would instead output the event as structured JSON. Splunk can be set to auto extract those, and JSON deals with cases like quoting and embedding delimiters in values.

Re: Default delimiters for key value extraction

helge — Wed, 02 Jul 2014 14:31:28 GMT

Do you mean there is no static list of default delimiters? That seems unlikely.

Re: Default delimiters for key value extraction

gkanapathy — Wed, 02 Jul 2014 14:48:14 GMT

I mean that if you're looking for a clear definition, you should use something with a clear standard definition, rather than something that is arbitrary, undocumented, and may change from version to version.

Re: Default delimiters for key value extraction

helge — Thu, 03 Jul 2014 14:16:18 GMT

This really should be documented by Splunk.

Re: Default delimiters for key value extraction

madavies — Fri, 09 Jan 2015 18:07:25 GMT

Interesting point/approach. Would be nice to have some more details from the Splunk team on this.