Default delimiters for key value extraction

[helge]

I have been sending key value data like the following to Splunk:

metric1=1.0 metric2=22 metric3="Some string"

I have manually wrapped values that may contain spaces in double quotes. I would like to formalize this and write a routine that automatically wraps values in quotes when necessary. To do that I need to know what the default delimiters are. I could not find a list anywhere.

Delimiters between key and value: anything else in addition to the equal sign (=)?

Delimiters between pairs: anything else in addition to the space ( )?

[gkanapathy]

If you're really looking for something cleanly defined, I would not rely on heuristic key-value detection, but would instead output the event as structured JSON. Splunk can be set to auto extract those, and JSON deals with cases like quoting and embedding delimiters in values.

[helge]

This really should be documented by Splunk.

[gkanapathy]

I mean that if you're looking for a clear definition, you should use something with a clear standard definition, rather than something that is arbitrary, undocumented, and may change from version to version.

[madavies]

Interesting point/approach. Would be nice to have some more details from the Splunk team on this.

[helge]

Do you mean there is no static list of default delimiters? That seems unlikely.

[somesoni2 · Accepted solution]

Comma is also one of the default delimiters between pairs. If your value contains a comma, it should be in double quotes. See this run anywhere example.

|gentimes start=-1 | eval _raw="First=Example Last=LastName,Email=Example,[email protected] Email2=\"Example,[email protected]\"" | table _raw | extract

This should be full list (per my knowledge)

space
comma
semicolon
pipe
ampersand
tab
new line

[helge]

I am looking for a full list of delimiters.

[martin_mueller]

Same story with semicolons, pipes, newlines, tabs, ...