https://community.splunk.com/t5/Splunk-Search/How-to-extract-field-with-fieldname-starts-with-a-quot-quot/m-p/33113#M7020 <P>Take a look at the DELIMS property in <A href="http://docs.splunk.com/Documentation/Splunk/latest/admin/transformsconf">transforms.conf</A></P> <P>Example :</P> <PRE><CODE>[foo] DELIMS = "#", "=" </CODE></PRE> Mon, 23 Apr 2012 02:08:01 GMT Damien_Dallimor 2012-04-23T02:08:01Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-field-with-fieldname-starts-with-a-quot-quot/m-p/33112#M7019 <P>Hi Guys</P> <P>Recently I have been dealing with some application logs and met some difficulties with field extraction.<BR /> Every fieldname is started with a "#", such as #field1=xxx#field2=yyy#field3=zzz#...<BR /> Then splunk extracted fields like: field1="xxx#field2=yyy#field3=zzz". How to tell splunk to threat "#" as a comma or space (means ignore the #) ?</P> <P>Would someone help me ? Thanks in advance!</P> <P>The log format is like:</P> <P>2012-04-16 17:41:27:087 [Inner-Tans-90013849] request:a60061152 102600 #oper_flag=1#user_type=2#user_id_type=1#user_id=1234567#user_pwd=897985d09890f41a4300#login_ip=192.168.1.1#bank_no=0000#net_envionment=2#net_agent=1#<BR /> 2012-04-16 17:41:27:087 [Inner-Tans-90013849] 1.Start:com.klink.btrs.product.system.imp.T9006<BR /> 2012-04-16 17:41:27:089 [Inner-Tans-90013849] com.klink.btrs.BtrsException: Invalid Username or password！<BR /> 2012-04-16 17:41:27:095 [Inner-Tans-10023849] response：a60061152 102600 HJ9999 #rsp_msg=Invalid Username or password！#</P> Mon, 28 Sep 2020 11:42:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-field-with-fieldname-starts-with-a-quot-quot/m-p/33112#M7019 sonicant 2020-09-28T11:42:18Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-field-with-fieldname-starts-with-a-quot-quot/m-p/33113#M7020 <P>Take a look at the DELIMS property in <A href="http://docs.splunk.com/Documentation/Splunk/latest/admin/transformsconf">transforms.conf</A></P> <P>Example :</P> <PRE><CODE>[foo] DELIMS = "#", "=" </CODE></PRE> Mon, 23 Apr 2012 02:08:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-field-with-fieldname-starts-with-a-quot-quot/m-p/33113#M7020 Damien_Dallimor 2012-04-23T02:08:01Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-field-with-fieldname-starts-with-a-quot-quot/m-p/33114#M7021 <P>Hi Damien,<BR /> Thank you!<BR /> I added:<BR /> [logtest]<BR /> DELIMS = "#", "="<BR /> in transforms.conf</P> <P>and added:<BR /> [logtest]<BR /> REPORT-test = logtest<BR /> in props.conf, then it works!!</P> Mon, 23 Apr 2012 02:53:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-field-with-fieldname-starts-with-a-quot-quot/m-p/33114#M7021 sonicant 2012-04-23T02:53:19Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-field-with-fieldname-starts-with-a-quot-quot/m-p/33115#M7022 <P>Great! Happy Splunking <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Mon, 23 Apr 2012 02:58:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-field-with-fieldname-starts-with-a-quot-quot/m-p/33115#M7022 Damien_Dallimor 2012-04-23T02:58:06Z