Getting Data In

How to keep a semicolon in a Key-Value when KV_MODE=auto?

DennisFFM
Explorer

Hey guys,

I have a log file with multiple key-values and most of the values are containing semicolons.

Example:

Test1=ABC;11
Test2=ABC;123

In this example Splunk only extracts "ABC" as a value. The semicolon and numbers are not being extracted.

Is there a way to tell Splunk to extract everything after the equal sign?

0 Karma

somesoni2
Revered Legend

The default KV_MODE=auto stops collecting field values when a work breaker comes (dot, comma, semicolon etc). You would either have to setup custom search-time field extraction to capture everything you want OR if you've control over how things are logged, enclose the values within double quotes so that full value is captured by Splunk.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!