topic Re: Splunk HEC extract value incorrect when there is curly braces in value of key-value pairs. in Getting Data In

Splunk HEC extract value incorrect when there is curly braces in value of key-value pairs.

cdp_fap — Mon, 11 May 2020 10:21:10 GMT

Using HTTP Event Collector to receier data. When there is unwanted curly brace(s) in value. Event parse incorrect. How can I extract the data when there is {} in the data?

Re: Splunk HEC extract value incorrect when there is curly braces in value of key-value pairs.

to4kawa — Mon, 11 May 2020 12:42:36 GMT

props.conf

SEDCMD-trim = s/{(.*)}/\1/g s/=([^\"].*?)(,|$)/="\1"\2/g

Re: Splunk HEC extract value incorrect when there is curly braces in value of key-value pairs.

cdp_fap — Mon, 11 May 2020 12:59:35 GMT

I receiver data via SPLUNK HEC, and the {} is in data, not in the filed name.

Re: Splunk HEC extract value incorrect when there is curly braces in value of key-value pairs.

to4kawa — Mon, 11 May 2020 13:01:57 GMT

well, Is it JSON format?

Re: Splunk HEC extract value incorrect when there is curly braces in value of key-value pairs.

cdp_fap — Mon, 11 May 2020 13:25:50 GMT

Yes JSON fomat. something like: {key1=value1, key2=value2,....key3="xxxx{yyyyy", keyn1=valuen1}. The curly brace in value3 will result incorrect event parse.

Re: Splunk HEC extract value incorrect when there is curly braces in value of key-value pairs.

to4kawa — Mon, 11 May 2020 13:31:22 GMT

please provide actual log. (PII data masking)

your log looks like non-valid JSON.

reference: https://www.json.org/json-en.html

Re: Splunk HEC extract value incorrect when there is curly braces in value of key-value pairs.

cdp_fap — Mon, 11 May 2020 13:49:30 GMT

{RCD=MC, ASID=006F, TIMESTAMP=20132 07.04.48.140 -0400, SMFID=MYSSTEM , TEXT=" +This is a control {line FAPFENG} This is the last message line", path=SYSLOG, timezone=-0400, sourcetype=SYSLOG-logmsg, system=XY}

Re: Splunk HEC extract value incorrect when there is curly braces in value of key-value pairs.

to4kawa — Mon, 11 May 2020 14:03:29 GMT

TIMESTAMP=20132 07.04.48.140 -0400 really?
how about my updated answer?