topic Re: [Solved] How to extract fields with a space in a field name? in Splunk Search

[Solved] How to extract fields with a space in a field name?

AlexeySh — Fri, 26 Apr 2019 12:34:35 GMT

[edit - a workaround was found in the comments]

Hello,

We try to export VMware inventory to Splunk. A raw Splunk event looks like this:

VM="Template Debian 9", Powerstate="poweredOn", IP Address="100.100.100.100", Cluster="My Cluster Name", VM ID="12345", ... etc.

Splunk extracts perfectly well all fields without spaces in field name, like VM, Cluster, Powerstate, etc. But it can't extract the fields with spaces, like IP Address, VM ID, etc.; they are visible only in raw data, but not as fields.

We tried to use a rex command like that one:

rex field="IP Address" mode=sed "s/ /_/g"

but we didn't succeed.

Do you have any idea how we could extract these fields?

Thanks for the help.

Re: [Solved] How to extract fields with a space in a field name?

richgalloway — Fri, 26 Apr 2019 12:58:04 GMT

What are the props.conf settings for the sourcetype you are using for the data?
Splunk will parse key=value data quite well with the default settings, but does not handle embedded spaces without customization.

Re: [Solved] How to extract fields with a space in a field name?

AlexeySh — Fri, 26 Apr 2019 13:40:05 GMT

Actually we use DB Connect app to perform a query like "SELECT * FROM ".

And now you made me think that we can change field name directly in the DB Connect query!

Sometime you just need a second brain to think 🙂

Re: [Solved] How to extract fields with a space in a field name?

richgalloway — Fri, 26 Apr 2019 18:23:12 GMT

Yes, you can. If that solves your problem then please come back to answer the question and accept it to help future readers.

Re: [Solved] How to extract fields with a space in a field name?

PowerPacked — Fri, 26 Apr 2019 19:04:50 GMT

Check with CLEAN_KEYS setting in props.conf, if it can help.

Thanks