https://community.splunk.com/t5/Splunk-Search/Is-there-any-way-to-selectively-avoid-automatic-field-extraction/m-p/43389#M10200 <P>The trouble is that there's a huge number of fields for which I need the normal equals sign autokv extraction to work. I tried specifying a manual regex for equals but there's a bunch of subtlety that autokv just does really well when you look at it under a microscope and I couldnt get the manual regex to the desired standard.</P> Sun, 13 Feb 2011 04:08:17 GMT sideview 2011-02-13T04:08:17Z https://community.splunk.com/t5/Splunk-Search/Is-there-any-way-to-selectively-avoid-automatic-field-extraction/m-p/43385#M10196 <P>I have multiline events where there's a fair bit of auto-kv extraction that is good, but then there's a lot of noise as well. </P> <P>I can create regexes to match the really noisy bits and this works well. I nearly get perfect coverage on the high-value fields that I actually need. </P> <P>The problem is that even when I have a regex matching, sometimes the same field appears in a foo=bar pair further down into the event, and the autoKV match is clobbering my more explicit regex match. Can someone point me in the right direction? (Obviously the answer is to make the logging less deranged, but it's not an option atm unfortunateley)</P> <PRE><CODE>------------------------------------- Fields: Field=GoodValue;foo=bar;jackiechan=theman AnotherGoodField = AnotherGoodValue User = bob ..... Field : BadNoisyValueThatClobbersMyGoodValue ------------------------------------- </CODE></PRE> <P>One idea is - can I tell the autokv stuff not to pay attention to colons? All the colon stuff is hideously noisy in this sourcetype.</P> Sat, 12 Feb 2011 05:42:52 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-any-way-to-selectively-avoid-automatic-field-extraction/m-p/43385#M10196 sideview 2011-02-12T05:42:52Z https://community.splunk.com/t5/Splunk-Search/Is-there-any-way-to-selectively-avoid-automatic-field-extraction/m-p/43386#M10197 <P>You could disable KV discovery for a particular source, host, or sourcetype in <STRONG>props.conf</STRONG>. Maybe this would help:</P> <P>PROPS.CONF:</P> <PRE><CODE>[mysourcetype] KV_MODE = none </CODE></PRE> Sat, 12 Feb 2011 06:35:03 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-any-way-to-selectively-avoid-automatic-field-extraction/m-p/43386#M10197 Ron_Naken 2011-02-12T06:35:03Z https://community.splunk.com/t5/Splunk-Search/Is-there-any-way-to-selectively-avoid-automatic-field-extraction/m-p/43387#M10198 <P>I don't believe it looks for colons, by default.</P> Sat, 12 Feb 2011 06:37:20 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-any-way-to-selectively-avoid-automatic-field-extraction/m-p/43387#M10198 Ron_Naken 2011-02-12T06:37:20Z https://community.splunk.com/t5/Splunk-Search/Is-there-any-way-to-selectively-avoid-automatic-field-extraction/m-p/43388#M10199 <P>From what I can tell it's definitely matching colons all over the place.</P> Sun, 13 Feb 2011 04:04:41 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-any-way-to-selectively-avoid-automatic-field-extraction/m-p/43388#M10199 sideview 2011-02-13T04:04:41Z https://community.splunk.com/t5/Splunk-Search/Is-there-any-way-to-selectively-avoid-automatic-field-extraction/m-p/43389#M10200 <P>The trouble is that there's a huge number of fields for which I need the normal equals sign autokv extraction to work. I tried specifying a manual regex for equals but there's a bunch of subtlety that autokv just does really well when you look at it under a microscope and I couldnt get the manual regex to the desired standard.</P> Sun, 13 Feb 2011 04:08:17 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-any-way-to-selectively-avoid-automatic-field-extraction/m-p/43389#M10200 sideview 2011-02-13T04:08:17Z https://community.splunk.com/t5/Splunk-Search/Is-there-any-way-to-selectively-avoid-automatic-field-extraction/m-p/43390#M10201 <P>It does the colon matching in WinEventLog:: (and maybe WMI::) sourcetypes.</P> Tue, 15 Feb 2011 09:54:55 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-any-way-to-selectively-avoid-automatic-field-extraction/m-p/43390#M10201 gkanapathy 2011-02-15T09:54:55Z https://community.splunk.com/t5/Splunk-Search/Is-there-any-way-to-selectively-avoid-automatic-field-extraction/m-p/43391#M10202 <P>The colon matching isn't handled by the KV_MODE switch, but by a different search-time extract.</P> Tue, 15 Feb 2011 09:55:25 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-any-way-to-selectively-avoid-automatic-field-extraction/m-p/43391#M10202 gkanapathy 2011-02-15T09:55:25Z