How to modify field extraction?

[balcv]

I have a data source that is being ingested into Splunk using a default field extraction which is working fine.  The data looks like:

DateTime=2020-11-24-10.38.00.869407,type=New-Request,Username=9999999,Client-Mac=F8-4E-73-xx-xx-xx,Called-Station-Id=A0-D3-C1-zz-zz-zz,SSID=myWiFi,NAS-IP=192.168.141.130,Nas-Identifier=CISCO_AP:CN3AD338P5,NAS-Port-Type=Wireless-802.11,Campus=SMB,Location=SMB Buildings HI

The data is being parsed correctly and I get the field name / value pairs in Splunk no problem (field_name=value).  The issue I have is the last field, Location.

The default field extraction is extracting the Location field however if the value contains spaces I am only getting up to the first space as the value in the indexed data.  From the above example, my Location data is returning "SMB" only and not "SMB Buildings HI". 

Is there any way to resolve this to either prevent it splitting the value at the space, or to replace the space with another character such as '_'.

[to4kawa]

props.conf:

SEDCMD-kv = s/=([^,]+)(,|$)/="\1"\2/g


work around:

| rex "Location=(?<Location>[^,]+),|$"

[thambisetty]

@balcv 

share details of TA and it's version to check configuration and to provide you fix.

[balcv]

Thanks for replying @thambisetty , but what is TA?