topic Re: Quoted escape characters when searching a field in Splunk Search

Quoted escape characters when searching a field

JoeSco27 — Thu, 19 Dec 2013 16:32:24 GMT

"2013-12-19 11:13:23", "[INFO]", "30927", "MainProcess", "SSMITH"

My data is coming into Splunk in this format, and when I select to look at it in raw form this is an example of one of my logs. The issue I am having is that when I want to search for a field I have to search for it in the following way or it wont show up:

levelname="\"[INFO]\""

I need the initial quotes around each field because some of the fields may have commas in them and the delimiter is also a comma. Is there a config I can use so I don't have to escape the quotes when searching for a field value? Or any advice besides changing the delimiter to fix the issue?

Re: Quoted escape characters when searching a field

richgalloway — Thu, 19 Dec 2013 17:51:53 GMT

Use a REGEX to parse the data. Put this in your transforms.conf file instead of DELIMS:

[<transformName>] REGEX = \"(?<EventTime>.*?)\",\s\"(?<Level>.*?)\",\s\"(?<Field3>.*?)\",\s\"(?<Field4>.*?)\",\s\"(?<Field5>.*?)\"

Re: Quoted escape characters when searching a field

JoeSco27 — Thu, 19 Dec 2013 20:42:07 GMT

I appreciate the quick response, but I would prefer not to have to do a index-time field extraction. Additionally, this is just a piece of my log, I have an additional 20 or so fields. Does anyone know of any other way around this? I could use this as a last resort but would rather not have to.

Re: Quoted escape characters when searching a field

lukejadamec — Thu, 19 Dec 2013 23:58:54 GMT

This is a search time field extraction in a config file (what you asked for). I'm not sure how to configure this to apply to only this field, but it would not surprise me if it's possible.

Re: Quoted escape characters when searching a field

somesoni2 — Fri, 20 Dec 2013 00:41:46 GMT

This could work for as an easiest options, but you need to include it in every search you make (as compare to search time field extraction suggested by @richgalloway, which you just configure once).

<your search starter index=blah sourcetype=blah> | replace "\"*\"" with "*" |<...rest of your search>

This will replace all the instance of '"value"' with 'value'.