topic Events with Tab Delimited values in Splunk Search

Events with Tab Delimited values

akshatj2 — Wed, 28 Aug 2019 01:18:46 GMT

Hi All,

I have some logs which are mostly tab delimited I used props and transforms to set up the delimited extractions but in a few logs we have back slash("\") as a field value. Looks like Splunk is unable to handle the same with delimited extractions.

has anyone faced similar issue earlier or if there is any solution for the same.

Example Below:

Sample Logs:
Log1: Hostname abc \ xyz
Log2: Hostname abc domain\username xyz

Currently with delimited extraction: I am getting below values
Log 1:
Field 1: Hostname
Field 2:abc
Field 3: \

xyz

Log 2:
Field 1: Hostname
Field 2:abc
Field 3: domain\username
Field 4: xyz

Re: Events with Tab Delimited values

Sukisen1981 — Wed, 28 Aug 2019 08:02:22 GMT

you need 3 backslashes
somethinf like this

[source::blah blah]
SEDCMD-removebackslsh = s/\\//g

test on the web first

   | makeresults 
         |  eval x="Hostname abc \ xyz" 

     | rex mode=sed field=x "s/\\\//g"

Re: Events with Tab Delimited values

Sukisen1981 — Thu, 29 Aug 2019 16:27:22 GMT

hi @ akshatj2
Please accept the answer if it helped resolve your issue, or let us know what more is needed to resolve your issue

Re: Events with Tab Delimited values

akshatj2 — Thu, 29 Aug 2019 16:45:48 GMT

Hi Sukisen

Thank you for suggestion but my we do not want to remove the backslash available. We wanted to parse that backslash as a filed value using delimiter. Looks like I have found a solution though I am just testing it and should post the answer soon.