How to keep a semicolon in a Key-Value when KV_MODE=auto?

[DennisFFM]

Hey guys,

I have a log file with multiple key-values and most of the values are containing semicolons.

Example:

Test1=ABC;11
Test2=ABC;123

In this example Splunk only extracts "ABC" as a value. The semicolon and numbers are not being extracted.

Is there a way to tell Splunk to extract everything after the equal sign?

[somesoni2]

The default KV_MODE=auto stops collecting field values when a work breaker comes (dot, comma, semicolon etc). You would either have to setup custom search-time field extraction to capture everything you want OR if you've control over how things are logged, enclose the values within double quotes so that full value is captured by Splunk.