topic Re: filed ignore textx within " " in Splunk Search

filed ignore textx within " "

patelmc — Tue, 25 Jan 2022 22:08:49 GMT

Hello,

I see following in _raw. However, when I run search with table or fields it does not display text within double quote despite its in _raw. "ptp-slave" does not get displayed as a value for field title. it only displays PTP State is ptp-listeining, should be.

2022-01-25 21:47:57.047, id="12342ee7c-757e-71ec-1090-777c841f0000", version="15119", title="PTP State is ptp-listening, should be "ptp-slave"", state="OPEN", severity="CRITICAL", priority="MEDIUM", --> there are more fields after this.

How can get entire test to be displayed.

Re: filed ignore textx within " "

ITWhisperer — Tue, 25 Jan 2022 22:54:37 GMT

Embedded double quotes would normally be escaped, but since they aren't, you could use a look ahead to use another pattern to find the end of the field, e.g. ", the caveat being that if you have an embedded ", this will also fail to extract the field correctly

| makeresults | eval _raw="2022-01-25 21:47:57.047, id=\"12342ee7c-757e-71ec-1090-777c841f0000\", version=\"15119\", title=\"PTP State is ptp-listening, should be \"ptp-slave\"\", state=\"OPEN\", severity=\"CRITICAL\", priority=\"MEDIUM\"" | rex max_match=0 "=\"(?<field>.+?)(?=\"(,|$))"

Re: filed ignore textx within " "

patelmc — Tue, 25 Jan 2022 23:20:42 GMT

Thanks, but it can be risky as you mentioned.

Was hoping Splunk should have ignore internal " ".

Could be a bug?

Re: filed ignore textx within " "

ITWhisperer — Wed, 26 Jan 2022 06:15:39 GMT

It is not a bug, at least not a bug in splunk - how would splunk know whether a double quote was an internal one or not?

The bug (if you want to call it that) lies with the application generating the message. The quoted string needs to escape embedded delimiters, double quotes in this instance, but if the string was enclosed in single quotes instead, then any embedded single quotes (including apostrophes) would need to be escaped.

Depending on how you are extracting the fields, you may be able to reduce the risk even further, but extracting one field at a time and using the name of the following field as part of the end marker for the field.

topic Re: filed ignore textx within &quot; &quot; in Splunk Search

filed ignore textx within " "

Re: filed ignore textx within " "

Re: filed ignore textx within " "

Re: filed ignore textx within " "

topic Re: filed ignore textx within " " in Splunk Search