Splunk DB Connect 2.3.0: How to properly extract fields from database events that contain spaces in the field names?

[bharathkumarnec]

Hello All,

We are using Splunk DB Connect 2.3.0. Below are the sample of events:

Severity Code = "103",Transition Code="111"

"Severity Code" & Transition Code" are not showing in the fields list. Instead, we are able to see only fields with name "Code", as there is a white space in between the two words of the field names.

How to extract fields completely with "Severity Code" & "Transition Code"?

Kindly help me out.

Regards,

[rodrigorsilva]

It would be simpler to adjust the input, avoid writing a regex...

Example: Select `Severity Code` as Severity_Code, `Transition Code` as Transition_Code from [your_table] ...

Tks

Rodrigo Ribeiro

[bharathkumarnec]

We have not explicitly specified sourcetype for these events, our db connect app configured in Search head server.

If we need to specify the sourcetype, what all we need to include and this sourcetype stanza should be in searchhead, indexer or both??

Thanks for your help!

[richgalloway]

It's a Splunk Best Practice to explicitly specify a sourcetype for all inputs. It should be defined on the node where DB Connect is running. Choose the best props.conf settings for your data. If you elect to use REGEX string, this one may get you started: Severity Code = "(?<severity>\d+)",Transition Code="(?<transition>\d+)".

[richgalloway]

What sourcetype are you using and what are the props.conf settings for that sourcetype?