NOT extracting key pair values found in a URL

torowa — Wed, 28 Feb 2018 06:29:01 GMT

Hi Splunkers.

Is there a way to prevent the extraction of KPV in a specific field/fields?

To explain further, a set of firewall logs contains a number of key=value pairs.
These are being extracted automatically by Splunk.

There is also (depending on the site) what appears to be key-values within the URL field.
These aren't values I am interested in extracting as they are simply part of the page served from the remote web server.

Is there any way to NOT extract these (perceived) key-values on a per field basis (for URL and other fields) as once extracted, some end up with field names matching CIM field names.

The only setting relating to this seems to be for disabling key-values extraction for an entire sourcetype, not individual fields.

Thanks.

Re: NOT extracting key pair values found in a URL

FrankVl — Wed, 28 Feb 2018 13:45:54 GMT

I think you would indeed need to disable auto KV (so set KV_MODE=none) and define a suitable field extraction explicitly for that sourcetype.

Since you're mentioning firewall logs, isn't there a TA available that takes care of such things for you? I would expect that most firewall brands have a TA on splunkbase?

topic NOT extracting key pair values found in a URL in Getting Data In

NOT extracting key pair values found in a URL

Re: NOT extracting key pair values found in a URL