Getting Data In

How to avoid influence of equal sign in text string when Splunk HEC parses JSON?

cdp_fap
Observer

I was tring to ingest data into Splunk via HEC. One field of my data is:

myKey1 = " This is my Application message log, myKey2=myValue2 in the text."  There is a Key=VALUE enclosed in the value of Field_name.

Splunk will parse the data into two key:

myKey1 = " This is my Application message log, KEY=VALUE in the text." 

myKey2=myValue2

myKey2=myValue2 is part of the myKey1.

 

I don't want it. What I can do to avoid the influence of an equal sign in the text string?

 

Labels (1)
0 Karma

dural_yyz
Motivator

Question: Have you attempted the same search SPL in 'Fast Mode' vs 'Smart or Verbose Modes'.   Part of the power of Splunk is how much it tries to help you.  In this case the Search Head may be trying to auto detect fields for the user.

You could if required reduce the length of the event which field discovery will attempt, I believe default is ~10,000 characters to something much lower.  However, I think that would overall be a poorer experience for your user base.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

    Thursday, June 25, 2026  |  11AM PDT / 2PM EDT  Duration: 1 Hour (Includes live Q&A) Register to ...

Analytics Workspace deprecation

As of Splunk Cloud Platform 10.4.2604 and Splunk Enterprise 10.4, Analytics Workspace is now deprecated. ...

Splunk Developer Day Recap: Building, Publishing, and Growing on the Splunk Platform

Splunk Developer Day brought the Splunk developer community together for a practical look at what it means to ...