Automatic field extractions from a quoted string

sfrazer — Mon, 28 Sep 2020 19:30:23 GMT

Our nginx access logs use a quoted string when dumping cookies. It ends up looking something like this:

"cookie_a=value_a; cookie_b=value_b; cookie_c=value_c" 192.168.1.1

The trouble comes when the auto-extractor hits cookie_c and sees the quote as the beginning of a quoted string. It then gobbles up all the fields after the cookie and dumps them into that field. Because cookie order isn't deterministic, you end up with a certain percentage of cookie_c values that are correct and a smaller number that are not.

Is there anyway to offer a hint to the auto-extractor to make this not happen?

Re: Automatic field extractions from a quoted string

stephanefotso — Sat, 11 Apr 2015 12:14:08 GMT

Yes of course! your can create your search time field extraction with props.conf edit.
Let's suppose that The field should be extracted from events related to the accesslogs sourcetype.
1. Create your own props.conf file, and put it in $SPLUNK_HOME/etc/apps/yourappname/local.
2. configure your stanza like this:

[acceslogs]
EXTRACT-cookiec = cookie_c=(?<cookie_c>[^"]+)

and restart splunk

topic Automatic field extractions from a quoted string in Splunk Search

Automatic field extractions from a quoted string

Re: Automatic field extractions from a quoted string