Splunk Enterprise

How to modify field extraction?

balcv
Contributor

I have a data source that is being ingested into Splunk using a default field extraction which is working fine.  The data looks like:

 

DateTime=2020-11-24-10.38.00.869407,type=New-Request,Username=9999999,Client-Mac=F8-4E-73-xx-xx-xx,Called-Station-Id=A0-D3-C1-zz-zz-zz,SSID=myWiFi,NAS-IP=192.168.141.130,Nas-Identifier=CISCO_AP:CN3AD338P5,NAS-Port-Type=Wireless-802.11,Campus=SMB,Location=SMB Buildings HI

 

The data is being parsed correctly and I get the field name / value pairs in Splunk no problem (field_name=value).  The issue I have is the last field, Location.

The default field extraction is extracting the Location field however if the value contains spaces I am only getting up to the first space as the value in the indexed data.  From the above example, my Location data is returning "SMB" only and not "SMB Buildings HI". 

Is there any way to resolve this to either prevent it splitting the value at the space, or to replace the space with another character such as '_'.

Labels (1)
0 Karma

to4kawa
Ultra Champion

props.conf:

SEDCMD-kv = s/=([^,]+)(,|$)/="\1"\2/g


work around:

| rex "Location=(?<Location>[^,]+),|$"

0 Karma

thambisetty
SplunkTrust
SplunkTrust

@balcv 

share details of TA and it's version to check configuration and to provide you fix.

————————————
If this helps, give a like below.
0 Karma

balcv
Contributor

Thanks for replying @thambisetty , but what is TA?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...