Getting Data In

Quote delimited fields containing spaces

Builder

In the past our iis logs were space delimited with the user agent field using the plus sign as an internal delimiter, such as

KRFU+(VER+5.0/5.0.2.v20130730-3038;+Win7+6.1;+52.4/2215/-1;Server+Atlanta;00222003D1C5;3238LB934)

But with the change in the log file format the user agent field now looks like this

"KRFU (VER 5.0/5.0.2.v20130920-3090; WinServer 2008 R2 6.1; 18.6/62/-1;Server Atlanta Metro;005056AA6ED5;sta001)"

"KRFU (VER 5.0/5.0.2.v20130920-3090; WinServer 2008 R2 6.1; 15.8/0/-1;New York All-Purpose Server;005056A4000B;ws120)"

One server is named "Server Atlanta Metro" which contains 3 spaces. The other server is named "New York All-Purpose Server" which contains 4 spaces. Sometimes the server will have only one name with no spaces. This causes problems with space delimited fields.

So how do I tell Splunk to consume everything between the quotes as one field?

0 Karma

Splunk Employee
Splunk Employee

Try this:

\"(?<useragent>.*)\"
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!