Fields with spaces

[techsup]

Hello,

I've got a problem with 2008 eventlogs returns by universal forwarder.
My win 2008 R2 is a french version and Fields which extract by Splunk contains spaces and they are not be used.

Splunk 4.3.5

Ex :

...

OpCode=Informations

RecordNumber=45957

Keywords=Échec de l’audit

Message=Échec d’ouverture de session d’un compte.

Sujet : 

ID de sécurité :  AUTORITE NT\Système

Nom du compte :     MIB2011081$

...

No problem with 'OpCode' but 'Nom du compte' isn't usable yet appears in interesting fields.
With a Win2003 eventlog, no problem, 'Nom du compte' is automatically replace by 'Nom_du_compte' in interesting fields.

Any ideas ?

Thanks

[ambemou]

Hello,

I have a same issue on my splunk 5.0.4 with windows 2008 R2 french can you tell me how you solve this issue.

Thanks

[yannK · Accepted solution]

A workaround may be to create a field extraction for this specific field.

example with an inline field extraction :

| rex "Nom du compte :\s(?<Nom_du_compte>\w+)"

see http://docs.splunk.com/Documentation/Splunk/5.0/Knowledge/Addfieldsatsearchtime

[techsup]

Thanks, finally that's what I do.

[sihamUfp]

can you expline how to use rex in this example please