topic Re: Dealing with spaces in fields in Splunk Search

Dealing with spaces in fields

kjonzeatgmaildo — Mon, 28 Sep 2020 15:47:04 GMT

I am sending events into Splunk using a tool that has a notification engine. The notification engine only allows me to set a value which then extracts the message attribute for forwarding.

For instance I set the value "$reason" and what gets sent for that value can be one or many words. When the value sent is more than one word, Splunk will only parse the first word. Hence if the field in the syslog message is "event_id=Added registered device for user: jdoe", splunk will show it as "event_id Added". How do I get Splunk to read in the entire message knowing that I can't do anything to adjust the way the source sends it?

Re: Dealing with spaces in fields

somesoni2 — Fri, 31 Jan 2014 19:33:15 GMT

do your generated log file have only one field or multiple? If multiple fields, how are multiple filed separated?

Re: Dealing with spaces in fields

kjonzeatgmaildo — Fri, 31 Jan 2014 20:07:14 GMT

There are actually many fields all of which are separated by spaces. Actually here's what one looks like

name="Registration Event" event_id=$message vendor="Extreme Networks" product=NAC RegistrationType=$type RegistrationTime=$time RegistrationMessage=$message RegistrationSource=$source

If the answer from any of these attributes is more than one word, Splunk ignores it even though it's in the raw message that Splunk receives.

Re: Dealing with spaces in fields

grijhwani — Sat, 01 Feb 2014 00:10:39 GMT

Can you rewrite your message templates to include quotation marks enclosing the token substitutions? For example:

name="Registration Event" event_id="$message" vendor="Extreme Networks" product="NAC" RegistrationType="$type" RegistrationTime="$time" RegistrationMessage="$message" RegistrationSource="$source"

Re: Dealing with spaces in fields

kjonzeatgmaildo — Mon, 03 Feb 2014 18:52:21 GMT

That was my first thought as well. I tried it and it had no effect what-so-ever. I doesn't seem as if I can do aything about how the events are sent; I need to do something on the Splunk side to make it understand that "$message" can be multiple words with spaces. Is this possible?

Re: Dealing with spaces in fields

somesoni2 — Mon, 03 Feb 2014 19:01:45 GMT

Will it be possible for you to change the field delimiter from space to comma?

Re: Dealing with spaces in fields

Ayn — Mon, 03 Feb 2014 19:12:03 GMT

I usually define my own key/value extraction for this. As long as there's a good way of specifying what the key and what the value is this works fine. Something like this:

[my_kv_extract]
REGEX = ([^=]+)="([^"]+)
FORMAT = $1::$2