topic Re: How to override automatic key-value extraction which contain single quotes? in Getting Data In

How to override automatic key-value extraction which contain single quotes?

koshyk — Fri, 27 Jul 2018 15:15:31 GMT

We have got some data in below format

2018-07-26T01:00:01 empID=12345 empName='Spider Man' department='IT'
2018-07-26T01:00:02 empID=12346 empName='Super Man' department='HR'

When splunk extracts (automatically), the fields contains single quotes '
eg empName='Spider Man'

But customer doesn't need to see the single quotes !!
Any Better way to remove the automatic extraction ,so we can say the value is Spider Man and NOT 'Spider Man'

(I understand, I can write regex to do this. But prefer if we do via props.conf or transforms.conf in simplest way possible)

Re: How to override automatic key-value extraction which contain single quotes?

akocak — Fri, 27 Jul 2018 16:27:14 GMT

I don't think you need transforms for this task.
you simply need to add following or similar to your props under your sourcetype:(note " ' " in replace)

    [mysourcetype]
    .....
    EVAL-empName = nullif(replace(empName,"'",""),"-")

Re: How to override automatic key-value extraction which contain single quotes?

patilsonali1729 — Tue, 29 Sep 2020 20:40:12 GMT

Hello,
Try using below in tensforms.conf.

[mytransform]
REGEX = \s+(\w+)='(.*?)'
FORMAT = $1::$2
MV_ADD = true
REPEAT_MATCH = true

Use the correct name in props.conf(mytransform) e.g
[]
REPORT-fieldextr = mytransform

Re: How to override automatic key-value extraction which contain single quotes?

koshyk — Sat, 28 Jul 2018 12:09:44 GMT

thanks mate. Prefer this as it is simple

Re: How to override automatic key-value extraction which contain single quotes?

koshyk — Sat, 28 Jul 2018 12:10:06 GMT

thanks. upvoted, but preferred the above person's option as it is simpler.

Re: How to override automatic key-value extraction which contain single quotes?

akocak — Sat, 28 Jul 2018 15:48:00 GMT

your welcome