topic Re: how to avoid auto extraction in quotes? in Splunk Search

how to avoid auto extraction in quotes?

yasein — Sun, 09 Aug 2015 03:44:11 GMT

I have logs like
msg="some string here method=aaaa" method=bbbb
splunk may extract method=aaaa out of the quoted string, how can I avoid this?

Thanks

Re: how to avoid auto extraction in quotes?

woodcock — Sun, 09 Aug 2015 13:39:47 GMT

So far as I.know, you cannot. Your only option is to set KV_MODE=none in props.conf and then do the field extractions yourself and build them explicitly so each does the corrrect thing in context.

Re: how to avoid auto extraction in quotes?

yasein — Tue, 11 Aug 2015 00:17:21 GMT

Thanks.
THe none KV_MODE solved my problem

props.conf

KV_MODE = none
REPORT-field_extract                            = field_extract

transforms.conf

[field_extract]
DELIMS = " ", "="

Re: how to avoid auto extraction in quotes?

jacobpevans — Wed, 04 Sep 2019 14:40:07 GMT

I know this is old, but I figured out a workaround for this. If you have control over the inputs, change it to be like this:

msg="some string here method~aaaa" method=bbbb

And then in your search, change it back, e.g.

| eval msg = replace(msg, "~", "\"")