https://community.splunk.com/t5/Splunk-Search/Field-discovery-with-multi-value-containing-space/m-p/69779#M17488 <P>Hi, <BR /> I'm trying to understand how the Field Discovery part works by default while dealing with a multi-value string containing spaces. <BR /> e.g I have like 50 fields similar to following which takes the format key1=value1 with a few exceptions where there are more than one value to the key; key2=value3 value4. Note the "space" between the two values here.</P> <P>category=auto model=new color=red blue green type=sports</P> <P>I have a choice of updating my message signature.</P> <P>Q. I would like to know what is the best way to escape the space between red blue red?<BR /> Q. Putting the whole value side in the couble-quotes (") like following would solve this problem?<BR /> category=auto model=new color="red blue green" type=sports<BR /> Q. Any other alternative?</P> Fri, 02 Sep 2011 21:50:14 GMT swapsapar 2011-09-02T21:50:14Z https://community.splunk.com/t5/Splunk-Search/Field-discovery-with-multi-value-containing-space/m-p/69779#M17488 <P>Hi, <BR /> I'm trying to understand how the Field Discovery part works by default while dealing with a multi-value string containing spaces. <BR /> e.g I have like 50 fields similar to following which takes the format key1=value1 with a few exceptions where there are more than one value to the key; key2=value3 value4. Note the "space" between the two values here.</P> <P>category=auto model=new color=red blue green type=sports</P> <P>I have a choice of updating my message signature.</P> <P>Q. I would like to know what is the best way to escape the space between red blue red?<BR /> Q. Putting the whole value side in the couble-quotes (") like following would solve this problem?<BR /> category=auto model=new color="red blue green" type=sports<BR /> Q. Any other alternative?</P> Fri, 02 Sep 2011 21:50:14 GMT https://community.splunk.com/t5/Splunk-Search/Field-discovery-with-multi-value-containing-space/m-p/69779#M17488 swapsapar 2011-09-02T21:50:14Z https://community.splunk.com/t5/Splunk-Search/Field-discovery-with-multi-value-containing-space/m-p/69780#M17489 <P>Putting the value inside quotes will make splunk take "red blue green" as one value for "color", not a multivalue field. You could take this approach and then use:</P> <PRE><CODE>|makemv delim=" " color </CODE></PRE> <P>And splunk will make it a multivalue field.</P> <P>If you'd like splunk to treat the these items as a multivalued field without using the search language, you'll need to setup fields.conf for the regex that defines the different values. Take a look at this portion of the documentation: <A href="http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/ConfigureSplunktoparsemulti-valuefields">Multivalue Vields</A></P> <P>the example fields.conf file has a great example doing something similar with the email "to" field.</P> Sat, 03 Sep 2011 09:52:00 GMT https://community.splunk.com/t5/Splunk-Search/Field-discovery-with-multi-value-containing-space/m-p/69780#M17489 bbingham 2011-09-03T09:52:00Z