Getting Data In

Indexed field with spaces in the value

vbumgarn
Path Finder

What is the proper way to create an indexed field with spaces in it?

Given something like:

log message foo="value with spaces"

I can't seem to come up with a transform that allows me to search against that value. I have a good reason for an indexed field (capturing millions of disparate sources without exploding Sources.meta), but the filenames have spaces in them.

Here's the closet I've been able to come, but the search requires a * on the end, like orig_source="value with spaces*" to work.

[copy_source]
SOURCE_KEY=MetaData:Source
REGEX=source::(.*)
FORMAT=orig_source::"$1"
WRITE_META = true

I have also tried

FORMAT="orig_source::$1"

and:

FORMAT=orig_source::$1

to no avail.

Thoughts?

1 Solution

dwaddle
SplunkTrust
SplunkTrust

Have you also added the indexed field to fields.conf ? Something like:

[orig_source]
INDEXED=true

This may not help your issue, but ISTR that it is required.

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

Have you also added the indexed field to fields.conf ? Something like:

[orig_source]
INDEXED=true

This may not help your issue, but ISTR that it is required.

vbumgarn
Path Finder

Success. The combination of INDEXED=true in fields.conf and FORMAT=newfield::"$1" in transforms.conf seems to do the trick.

0 Karma

vbumgarn
Path Finder

Actually, I may have it working...
INDEXED=true

FORMAT=newfield::"$1"

Maybe.

0 Karma

vbumgarn
Path Finder

It doesn't seem to matter. Give it a try and see if you can come up with a working example.

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...