Incomplete field value

[swetar]

Hi,
I am passing a log file . The field values for message field is incomplete. Also the Message field has many pattern.
Can any one suggest me. How can i handle this in prof.conf

Log file
Name=ABC
PLACE=XXX
MESSAGE=PQRS is a valid :CCCC is true
CATEGORY=ZEB
Output

NAME=ABC
PLACE=XXX
MESSAGE=PQRS
CATEGORY=ZEB

Thanks

[woodcock]

Use a transform like this:

(?<_KEY_1>[^=\s]+)=(?<_VAL_1>[^=]+)(?=$|\s+[^=\s]+=)

See here:
https://regex101.com/r/4vV2LN/1

[somesoni2]

YOu probably need to setup custom field extractions for this, specially for the fields which have multiple words, similar to this

https://regex101.com/r/ItDDD6/1

Also, if you've control over how the logging is done, then you could update your logger to log the field value within double quotes so that Splunk can automatically do the full field extraction.