topic I want to index fieldName which contains square brackets in Splunk Search

I want to index fieldName which contains square brackets

pallavikarpaklu — Tue, 06 Oct 2020 17:31:48 GMT

Hi,

I want to index a fieldName which contains square brackets

Below is the key-value pair format I have and splunk is not indexing keys value which consists []
eg: root[60]_level[5]=value

Any suggestions?

Re: I want to index fieldName which contains square brackets

richgalloway — Tue, 06 Oct 2020 18:06:34 GMT

Square brackets are not allowed in field names. If Splunk encounters such a field name, it will convert the unacceptable characters into underscores.

Re: I want to index fieldName which contains square brackets

pallavikarpaklu — Wed, 07 Oct 2020 00:01:49 GMT

Thanks for the response.

But as I mentioned earlier splunk is logging as root[60]_level[5]=value
[] are not converted to underscores.

Do I need to do any property changes for that ?

Suppose the conversion is done and my key is replaced with double underscores like below "root_60__level_5_=value"
Does splunk honurs double underscore and still index the key "root_60__level_5_"?

Re: I want to index fieldName which contains square brackets

Nisha18789 — Wed, 07 Oct 2020 10:16:33 GMT

Hi @pallavikarpaklu , could you please give example of what is the actual key-value pair in log and what Splunk is indexing ?

Re: I want to index fieldName which contains square brackets

pallavikarpaklu — Wed, 07 Oct 2020 18:13:12 GMT

Sure. Below is the sample logger with two keys "root[60]_level[5]" and "root_string".

2020-10-07 17:50:04,208 - INFO - root[60]_level[5]=value, root_string=value

root_string - This key is indexed

root[60]_level[5] - This key is not indexed.

I am open to try any kind of key transformations but I want the key to be indexed. Please suggest.

Re: I want to index fieldName which contains square brackets

Nisha18789 — Thu, 08 Oct 2020 21:45:50 GMT

hi @pallavikarpaklu , could you please also provide the current props.conf/transforms.conf stanza you are using for indexing this data.