topic Re: How to keep a semicolon in a Key-Value when KV_MODE=auto? in Getting Data In

How to keep a semicolon in a Key-Value when KV_MODE=auto?

DennisFFM — Tue, 07 Aug 2018 10:15:51 GMT

Hey guys,

I have a log file with multiple key-values and most of the values are containing semicolons.

Example:

Test1=ABC;11
Test2=ABC;123

In this example Splunk only extracts "ABC" as a value. The semicolon and numbers are not being extracted.

Is there a way to tell Splunk to extract everything after the equal sign?

Re: How to keep a semicolon in a Key-Value when KV_MODE=auto?

somesoni2 — Tue, 07 Aug 2018 14:52:31 GMT

The default KV_MODE=auto stops collecting field values when a work breaker comes (dot, comma, semicolon etc). You would either have to setup custom search-time field extraction to capture everything you want OR if you've control over how things are logged, enclose the values within double quotes so that full value is captured by Splunk.