I'm a little bit upset with next problem...
If I run some script within splunk (powershell, python, etc) and put something to standard output, the event will be in splunk index and I can do normal search. For example:
Output Message: Metric=MyMetric,Value=MyValue
Search query in splunk: Metric=MyMetric
In this case I can search my event but...
if I send the same event within TCP, the search query can't find anything. It can but only if I use "Metric=MyMetric" (in quotes)
Does anybody know why? And what should I do in this case? Should I send my event in some special format?
That's probably because the data over TCP gets a different sourcetype with different extraction settings (props.conf). Seems like auto-key-value pair extraction is disabled for the particular sourcetype (
KV_MODE=none or similar).