topic Re: Incomplete field value in Getting Data In

Incomplete field value

swetar — Wed, 18 Jul 2018 09:10:08 GMT

Hi,
I am passing a log file . The field values for message field is incomplete. Also the Message field has many pattern.
Can any one suggest me. How can i handle this in prof.conf

Log file
Name=ABC
PLACE=XXX
MESSAGE=PQRS is a valid :CCCC is true
CATEGORY=ZEB
Output

NAME=ABC
PLACE=XXX
MESSAGE=PQRS
CATEGORY=ZEB

Thanks

Re: Incomplete field value

somesoni2 — Wed, 18 Jul 2018 14:06:37 GMT

YOu probably need to setup custom field extractions for this, specially for the fields which have multiple words, similar to this

https://regex101.com/r/ItDDD6/1

Also, if you've control over how the logging is done, then you could update your logger to log the field value within double quotes so that Splunk can automatically do the full field extraction.

Re: Incomplete field value

woodcock — Wed, 18 Jul 2018 14:25:12 GMT

Use a transform like this:

(?<_KEY_1>[^=\s]+)=(?<_VAL_1>[^=]+)(?=$|\s+[^=\s]+=)

See here:
https://regex101.com/r/4vV2LN/1