Knowledge Management

In summary index trailing char "=" of field values are stripped

clagese
Explorer

I create summary index and I have some values as encrypted string

example: applicant.msisdn="oaXjWo017vONwgUvO1WBvg=="
In the the summary index _raw field applicant.msisdn value is correct but the value of search-time extraction is applicant.msisdn=oaXjWo017vONwgUvO1WBvg with trailing "=" stripped.
I look at default transforms.conf for stash sourcetype :

[stash_extract]
DELIMS       = ",", "="
CAN_OPTIMIZE = false
MV_ADD       = true
CLEAN_KEYS   = false

I don't understand why the trailing "=" disappear e how I can correct this behavior
Thanks in advance

0 Karma

darshan
Observer

Hi @clagese , I have also stumbled on  the same issue. So did you manage  to find a way around this?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It would seem the DELIMS attribute is the culprit. The "=" tells Splunk to treat equals signs as a separator between a field name and its value. I don't know how to fix it, however, as changing that setting may affect all summary indexes.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...