How do I use delimiter attribute in transforms.conf to extract values for each individual field whose values are enclosed in double quotes ("")?

[mohammed7860]

Hi:

I have following sample events:

start_time="XXX" end_time="XXX" dest_dns="" dest_mac="" dest_ip="56.00.00.185" cpe="" dest_port_proto="6" dest_port="399" severity="2" signature_id="10001" signature_family="12" signature="The remote host supports the use of SSL ciphers that offer medium strength encryption, which we currently regard as those with key lengths at least 56 bits and less than 112 bits.\n\nNote: This is considerably easier to exploit if the attacker is on the same physical network." exploitAvailable="false" exploitEase="" synopsis="The remote service supports the use of medium strength SSL ciphers." solution="Reconfigure the affected application if possible to avoid use of medium strength ciphers." cve="" netbiosName="XXX" hasBeenMitigated="0" firstSeen="1481797392" lastSeen="1481797392" name="SSL Medium Strength Cipher Suites Supported" cvssVector="XXX" baseScore="4.3" temporalScore=""

How do I use delimiter attribute in transforms.conf to extract values for each individual field whose values are enclosed in ""?

Any help is greatly appreciated.

Mohammed

[bambarit]

try this

Spoiler

((?:[^\s\|]|(?<=\\)\|)+)=\"((?:\\\=|[^=])*)"

[securityForMe]

Hi
You can configure your file $SPLUNK_HOME/etc/apps//local/props.conf like this:

[REPORT-Something]
DELIMS = " " (with a space inside)
FIELDS = "filedname1","filedname2","filedname3"

Make sure you restart splunk after change the file, then you can get the keys by split with "=".

[somesoni2]

These are in standard Key value pair format and Splunk should automatically extract these fields. Have you tried ingesting it to Splunk and checked the default field extractions?

[mohammed7860]

The default field extractions don't work. I still see the values within double quotes

[sundareshr]

Please share the props.conf stanza your are using