Getting Data In

NOT extracting key pair values found in a URL

Path Finder

Hi Splunkers.

Is there a way to prevent the extraction of KPV in a specific field/fields?

To explain further, a set of firewall logs contains a number of key=value pairs.
These are being extracted automatically by Splunk.

There is also (depending on the site) what appears to be key-values within the URL field.
These aren't values I am interested in extracting as they are simply part of the page served from the remote web server.

Is there any way to NOT extract these (perceived) key-values on a per field basis (for URL and other fields) as once extracted, some end up with field names matching CIM field names.

The only setting relating to this seems to be for disabling key-values extraction for an entire sourcetype, not individual fields.


0 Karma

Ultra Champion

I think you would indeed need to disable auto KV (so set KV_MODE=none) and define a suitable field extraction explicitly for that sourcetype.

Since you're mentioning firewall logs, isn't there a TA available that takes care of such things for you? I would expect that most firewall brands have a TA on splunkbase?

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...