TCP vs Splunk cmd

[Vladimir]

Hi all!

I'm a little bit upset with next problem...

If I run some script within splunk (powershell, python, etc) and put something to standard output, the event will be in splunk index and I can do normal search. For example:

Output Message: Metric=MyMetric,Value=MyValue

Search query in splunk: Metric=MyMetric

In this case I can search my event but...

if I send the same event within TCP, the search query can't find anything. It can but only if I use "Metric=MyMetric" (in quotes)

Does anybody know why? And what should I do in this case? Should I send my event in some special format?

Thanks

[ziegfried · Accepted solution]

That's probably because the data over TCP gets a different sourcetype with different extraction settings (props.conf). Seems like auto-key-value pair extraction is disabled for the particular sourcetype (KV_MODE=none or similar).

[Vladimir]

Thanks! It's alive! 🙂

[Vladimir]

I even can't calculate any numeric values (stats sum/avg/mix/max/etc).
Splunk 4.2.2
Splunk Universal Forwarder 4.2.1 (input for tcp)