https://community.splunk.com/t5/Splunk-Search/Disable-Automatic-Field-Extraction/m-p/21673#M3586 <P>If you don't mind extracting the KV pairs manually for this data, you can set <CODE>KV_MODE=none</CODE> in props.conf for the source/sourcetype.</P> Thu, 07 Feb 2013 04:43:47 GMT Ron_Naken 2013-02-07T04:43:47Z https://community.splunk.com/t5/Splunk-Search/Disable-Automatic-Field-Extraction/m-p/21672#M3585 <P>Automatic field extraction is probably one of my favorite perks of throwing data into Splunk... but interestingly enough, it's causing a bit of an annoyance in this case.</P> <P>I have a log that looks more or less like this:</P> <PRE><CODE>Time: 01/02/13 01:02:58 PM Execution Time (ms): 0.234943 Statement Text: SELECT foo, bar FROM table t WHERE t.foo="blah" AND t.bar="something" </CODE></PRE> <P>Pretty straight-forward - but Splunk decided to extract key/value pairs from the SQL query. Above is a rather simple query.. but the real log contains some pretty large ones with column names all over the place, thus making the "X interesting fields" list HUGE and almost impossible to find the actual fields we want to extract.</P> Wed, 06 Feb 2013 15:49:19 GMT https://community.splunk.com/t5/Splunk-Search/Disable-Automatic-Field-Extraction/m-p/21672#M3585 Ricapar 2013-02-06T15:49:19Z https://community.splunk.com/t5/Splunk-Search/Disable-Automatic-Field-Extraction/m-p/21673#M3586 <P>If you don't mind extracting the KV pairs manually for this data, you can set <CODE>KV_MODE=none</CODE> in props.conf for the source/sourcetype.</P> Thu, 07 Feb 2013 04:43:47 GMT https://community.splunk.com/t5/Splunk-Search/Disable-Automatic-Field-Extraction/m-p/21673#M3586 Ron_Naken 2013-02-07T04:43:47Z https://community.splunk.com/t5/Splunk-Search/Disable-Automatic-Field-Extraction/m-p/21674#M3587 <P>Just what I was looking for - thanks!</P> Thu, 07 Feb 2013 17:03:29 GMT https://community.splunk.com/t5/Splunk-Search/Disable-Automatic-Field-Extraction/m-p/21674#M3587 Ricapar 2013-02-07T17:03:29Z