topic Why am I unable to extract values from the following logs? in Splunk Search https://community.splunk.com/t5/Splunk-Search/Why-am-I-unable-to-extract-values-from-the-following-logs/m-p/443120#M125739 <P>Every time I try extracting values for platform, testNames, testId and experience , I always get "\"</P> <P>Can you please suggest some query to extract these values.</P> <P>Log format :</P> <PRE><CODE>time="2018-12-20T22:00:54.868Z", message="bctest batch platform=\"Target\" testNames=\"fitBCTest\",[testName=\"fitBCTest\",testId=\"22323:0:0,\",experience=\"\"]", level="INFO" </CODE></PRE> <P>Expected Output:</P> <PRE><CODE>platform= Target testNames= fitBCTest testId= 22323:0:0 experience=\ </CODE></PRE> Thu, 20 Dec 2018 22:07:23 GMT saifullakhalid 2018-12-20T22:07:23Z Why am I unable to extract values from the following logs? https://community.splunk.com/t5/Splunk-Search/Why-am-I-unable-to-extract-values-from-the-following-logs/m-p/443120#M125739 <P>Every time I try extracting values for platform, testNames, testId and experience , I always get "\"</P> <P>Can you please suggest some query to extract these values.</P> <P>Log format :</P> <PRE><CODE>time="2018-12-20T22:00:54.868Z", message="bctest batch platform=\"Target\" testNames=\"fitBCTest\",[testName=\"fitBCTest\",testId=\"22323:0:0,\",experience=\"\"]", level="INFO" </CODE></PRE> <P>Expected Output:</P> <PRE><CODE>platform= Target testNames= fitBCTest testId= 22323:0:0 experience=\ </CODE></PRE> Thu, 20 Dec 2018 22:07:23 GMT https://community.splunk.com/t5/Splunk-Search/Why-am-I-unable-to-extract-values-from-the-following-logs/m-p/443120#M125739 saifullakhalid 2018-12-20T22:07:23Z Re: Why am I unable to extract values from the following logs? https://community.splunk.com/t5/Splunk-Search/Why-am-I-unable-to-extract-values-from-the-following-logs/m-p/443121#M125740 <P>In your props.conf you should specify KV_MODE = auto_escaped for a sourcetype like this to extract properly</P> Tue, 29 Sep 2020 22:31:42 GMT https://community.splunk.com/t5/Splunk-Search/Why-am-I-unable-to-extract-values-from-the-following-logs/m-p/443121#M125740 briancronrath 2020-09-29T22:31:42Z Re: Why am I unable to extract values from the following logs? https://community.splunk.com/t5/Splunk-Search/Why-am-I-unable-to-extract-values-from-the-following-logs/m-p/443122#M125741 <P>Were you trying to extract these fields using regex?</P> Fri, 04 Jan 2019 00:47:49 GMT https://community.splunk.com/t5/Splunk-Search/Why-am-I-unable-to-extract-values-from-the-following-logs/m-p/443122#M125741 alonsocaio 2019-01-04T00:47:49Z