tomcat:access:splunk:log --> why are there question marks before and after some field values like remote_ip

[MuratKuru]

Hi All
I have followed the instructions under 

"https://docs.splunk.com/Documentation/AddOns/released/Tomcat/Recommendedfields"

But as you can see on the pic below there are question marks before and after the field value.
Why is that needed?

Thank you in advance for your help.

[PickleRick]

As the doc you pointed to says, you defined the log pattern this way. I suppose (I don't know this addon so I only speculate), the parsing rules should retrieve the proper values from the log easier this way since they are delimited by those question marks. Not a pretties solution, but should probably work.

So, you defined a pattern and you're getting the raw events in the format you defined yourself.

The thing to check is whether they are getting parsed properly.