Getting Data In

NOT extracting key pair values found in a URL


Hi Splunkers.

Is there a way to prevent the extraction of KPV in a specific field/fields?

To explain further, a set of firewall logs contains a number of key=value pairs.
These are being extracted automatically by Splunk.

There is also (depending on the site) what appears to be key-values within the URL field.
These aren't values I am interested in extracting as they are simply part of the page served from the remote web server.

Is there any way to NOT extract these (perceived) key-values on a per field basis (for URL and other fields) as once extracted, some end up with field names matching CIM field names.

The only setting relating to this seems to be for disabling key-values extraction for an entire sourcetype, not individual fields.


0 Karma

Ultra Champion

I think you would indeed need to disable auto KV (so set KV_MODE=none) and define a suitable field extraction explicitly for that sourcetype.

Since you're mentioning firewall logs, isn't there a TA available that takes care of such things for you? I would expect that most firewall brands have a TA on splunkbase?

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!