Getting Data In

Does splunk allow spaces in key values?

marcus314
Engager

Splunk is not extracting the key-value pairs to the logs, and I'm wondering if this is because there are spaces in the keys and they're in quotes, or if it is because there isn't a space after the comma?

Example log:

Jul 25 11:24:31 banana-server 11:24:31,582 [b-thread-01] WARN BananaServiceWorker - Service Error: "Service Error Type"="SERVICE","Service Name"="The Banana Service","Error Code"="41","Error Message"="We are out of bananas."

0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

While Splunk Doesn't allow spaces in the fields (see url below) it might replace the spaces with an underscore. So your field to search on would be "Service_Error_Type", etc for each of those fields.

http://docs.splunk.com/Documentation/Splunk/5.0.3/Knowledge/Aboutfields

View solution in original post

alacercogitatus
SplunkTrust
SplunkTrust

While Splunk Doesn't allow spaces in the fields (see url below) it might replace the spaces with an underscore. So your field to search on would be "Service_Error_Type", etc for each of those fields.

http://docs.splunk.com/Documentation/Splunk/5.0.3/Knowledge/Aboutfields

marcus314
Engager

After playing around with it, I've learned that it does not allow spaces, and it doesn't allow quotes either to escape the spaces, without using special commands in the search field. In order to get it to properly use the auto extract, I had to get rid of the quotes and replace the spaces with underscores. Thanks.

0 Karma
Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Enhance Security Operations with Automated Threat Analysis in the Splunk EcosystemAre you leveraging ...

Splunk Developers: Go Beyond the Dashboard with These .Conf25 Sessions

  Whether you’re building custom apps, diving into SPL2, or integrating AI and machine learning into your ...

Index This | How do you write 23 only using the number 2?

July 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...