Getting Data In

Indexed field with spaces in the value

vbumgarn
Path Finder

What is the proper way to create an indexed field with spaces in it?

Given something like:

log message foo="value with spaces"

I can't seem to come up with a transform that allows me to search against that value. I have a good reason for an indexed field (capturing millions of disparate sources without exploding Sources.meta), but the filenames have spaces in them.

Here's the closet I've been able to come, but the search requires a * on the end, like orig_source="value with spaces*" to work.

[copy_source]
SOURCE_KEY=MetaData:Source
REGEX=source::(.*)
FORMAT=orig_source::"$1"
WRITE_META = true

I have also tried

FORMAT="orig_source::$1"

and:

FORMAT=orig_source::$1

to no avail.

Thoughts?

1 Solution

dwaddle
SplunkTrust
SplunkTrust

Have you also added the indexed field to fields.conf ? Something like:

[orig_source]
INDEXED=true

This may not help your issue, but ISTR that it is required.

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

Have you also added the indexed field to fields.conf ? Something like:

[orig_source]
INDEXED=true

This may not help your issue, but ISTR that it is required.

vbumgarn
Path Finder

Success. The combination of INDEXED=true in fields.conf and FORMAT=newfield::"$1" in transforms.conf seems to do the trick.

0 Karma

vbumgarn
Path Finder

Actually, I may have it working...
INDEXED=true

FORMAT=newfield::"$1"

Maybe.

0 Karma

vbumgarn
Path Finder

It doesn't seem to matter. Give it a try and see if you can come up with a working example.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...