topic Re: Why is Splunk 6.5.1 not able to search when event has data with delimiter ~ while field extraction is working as expected? in Splunk Search

Why is Splunk 6.5.1 not able to search when event has data with delimiter ~ while field extraction is working as expected?

NeerajDhapola7 — Thu, 16 Mar 2017 22:02:31 GMT

Why is Splunk 6.5.1 not able to search when event has data with delimiter ~, while field extraction is working as expected. Issue with search with extracted field=value

another question while extracting fields i was using !#! as separator but its not working.
Can't we use multiple characters as separator !#! ?

Thanks
Neeraj Singh Dhapola

Re: Why is Splunk 6.5.1 not able to search when event has data with delimiter ~ while field extraction is working as expected?

niketn — Fri, 17 Mar 2017 22:29:03 GMT

@NeerajDhapola7... Please add mocked up test data, field extraction you have created, search with issue and what is the issue.
Please provide more context for your second issue as well. Add example with special characters as separators and also what was the field extraction which did not work?

Following is a run anywhere example which works fine for me. Kindly provide more details and mock data so that we can assist.

| makeresults
| eval teststr="my test string !#! with ~ tilde and separator !#! with issues"
| rex field=teststr "(?<data1>.*)\!\#\!(?<data2>.*)\!\#\!(?<data3>.*)"
| eval newstr=if(match(data2,"~"),"Found Tilde","Tilde Not found")

Re: Why is Splunk 6.5.1 not able to search when event has data with delimiter ~ while field extraction is working as expected?

Masa — Mon, 20 Mar 2017 19:03:48 GMT

DELIMS = "~" should work for events like "Value01~Value02~Value03"
DELIMS = "!#!" will translated as "! OR # OR !" because DELIMS takes one character as a separator.

If this does not help, please provide examples of events, configuration of props and transforms.

Re: Why is Splunk 6.5.1 not able to search when event has data with delimiter ~ while field extraction is working as expected?

NeerajDhapola7 — Mon, 20 Mar 2017 19:32:42 GMT

@Masa Thanks for the response

DELIMS = "~" should work for events like "Value01~Value02~Value03"

Event data example :
2017/03/13 17:04:03.901000~13-MAR-17 05.04.03.885000 PM~13-MAR-17 05.04.03.886000 PM~xxx Client~xxxx~~com.ConnectionError: Error while connecting to remote host.~~~xxxxxxxx~xxxxxxxxxx~xxxxxx/~PASS~xxxxxx~BIS~~xxxx-xxxx-xxx-xx-xxxx~xxxx-0849-11e7-xxx-xxxxx~0~0
When you do mouse over to extract the field for the search splunk is not able to separate with ~ sign OR
once you did field extract after the if you do query on field (i.e field1=xxxx) not able to get result.

I hope this will make more clear. (as of now I have changed ~ to | )

DELIMS = "!#!" will translated as "! OR # OR !" because DELIMS takes one character as a separator. Yes, this one resolved the issue as I can use only one character as separator. Issue is when I am selection OTHER and its showing text box where I can give more then 1 character which is giving sense that I can use more then 1 characters as separator. Need to update TEXT box length as 1

Re: Why is Splunk 6.5.1 not able to search when event has data with delimiter ~ while field extraction is working as expected?

jaredlaney — Wed, 15 Jan 2020 21:39:20 GMT

This is an old question but I'm seeing the same strange behavior with tilde as a delimiter. I'm going to see if I can recreate with data.

Re: Why is Splunk 6.5.1 not able to search when event has data with delimiter ~ while field extraction is working as expected?

payl_chdhry — Fri, 13 Mar 2020 06:50:17 GMT

found any solution for this? We too as facing issue with tilde as delimiter.