Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: Splunk HEC extract value incorrect when there ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Splunk HEC extract value incorrect when there is curly braces in value of key-value pairs.
Using HTTP Event Collector to receier data. When there is unwanted curly brace(s) in value. Event parse incorrect. How can I extract the data when there is {} in the data?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
props.conf
SEDCMD-trim = s/{(.*)}/\1/g s/=([^\"].*?)(,|$)/="\1"\2/g
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I receiver data via SPLUNK HEC, and the {} is in data, not in the filed name.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
well, Is it JSON format?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes JSON fomat. something like: {key1=value1, key2=value2,....key3="xxxx{yyyyy", keyn1=valuen1}. The curly brace in value3 will result incorrect event parse.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
please provide actual log. (PII data masking)
your log looks like non-valid JSON.
reference: https://www.json.org/json-en.html
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
{RCD=MC, ASID=006F, TIMESTAMP=20132 07.04.48.140 -0400, SMFID=MYSSTEM , TEXT=" +This is a control {line FAPFENG} This is the last message line", path=SYSLOG, timezone=-0400, sourcetype=SYSLOG-logmsg, system=XY}
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
TIMESTAMP=20132 07.04.48.140 -0400 really?
how about my updated answer?
Building Reliable Asset and Identity Frameworks in Splunk ES
Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting
Automatic Discovery Part 3: Practical Use Cases
