Getting Data In

Indexed field with spaces in the value

vbumgarn
Path Finder

What is the proper way to create an indexed field with spaces in it?

Given something like:

log message foo="value with spaces"

I can't seem to come up with a transform that allows me to search against that value. I have a good reason for an indexed field (capturing millions of disparate sources without exploding Sources.meta), but the filenames have spaces in them.

Here's the closet I've been able to come, but the search requires a * on the end, like orig_source="value with spaces*" to work.

[copy_source]
SOURCE_KEY=MetaData:Source
REGEX=source::(.*)
FORMAT=orig_source::"$1"
WRITE_META = true

I have also tried

FORMAT="orig_source::$1"

and:

FORMAT=orig_source::$1

to no avail.

Thoughts?

1 Solution

dwaddle
SplunkTrust
SplunkTrust

Have you also added the indexed field to fields.conf ? Something like:

[orig_source]
INDEXED=true

This may not help your issue, but ISTR that it is required.

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

Have you also added the indexed field to fields.conf ? Something like:

[orig_source]
INDEXED=true

This may not help your issue, but ISTR that it is required.

vbumgarn
Path Finder

Success. The combination of INDEXED=true in fields.conf and FORMAT=newfield::"$1" in transforms.conf seems to do the trick.

0 Karma

vbumgarn
Path Finder

Actually, I may have it working...
INDEXED=true

FORMAT=newfield::"$1"

Maybe.

0 Karma

vbumgarn
Path Finder

It doesn't seem to matter. Give it a try and see if you can come up with a working example.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...