topic Re: How to avoid extracting fields from quoted values? in Splunk Search

How to avoid extracting fields from quoted values?

krisreeves — Sat, 14 Jul 2018 17:44:38 GMT

We've noticed that key=value pairs inside a quoted value get extracted too. For example, with an event like foo="bar=baz", the field foo will be extracted with the value bar=baz, but also the field bar will be extracted with the value baz. Is there a way to disable this behavior? (Splunk Enterprise 6.5.4)

This sometimes creates a problem when logging things like URLs that have query strings; if a query string contains a key that has the same name as another field in the event, the extraction of that query string value will override the value of the field we want (possibly later in the line)

Re: How to avoid extracting fields from quoted values?

thambisetty — Tue, 29 Sep 2020 20:26:58 GMT

Hi @krisreeves,

Automatic key-value field extraction is a search-time field extraction configuration that uses the KV_MODE attribute to automatically extract fields for events associated with a specific host, source, or source type. Configure automatic key-value field extractions by finding or creating the appropriate stanza in props.conf. You can find props.conf in $SPLUNK_HOME/etc/system/local/ or your own custom app directory in $SPLUNK_HOME/etc/apps/.

so set KV_MODE=none in props.conf to avoid auto kv extractions and write a custom parser for your events either index/search time.

Re: How to avoid extracting fields from quoted values?

woodcock — Sun, 15 Jul 2018 13:29:23 GMT

You should set KV_MODE = none to turn off this capability and then create your own unanchored RegEx as a REPORT- search-time extraction to do the same thing, but in a way that you control.

Re: How to avoid extracting fields from quoted values?

krisreeves — Thu, 19 Jul 2018 19:44:08 GMT

This is pretty unfortunate, but I haven't found a better solution 😕