Automatic field extractions from a quoted string

[sfrazer]

Our nginx access logs use a quoted string when dumping cookies. It ends up looking something like this:

"cookie_a=value_a; cookie_b=value_b; cookie_c=value_c" 192.168.1.1 

The trouble comes when the auto-extractor hits cookie_c and sees the quote as the beginning of a quoted string. It then gobbles up all the fields after the cookie and dumps them into that field. Because cookie order isn't deterministic, you end up with a certain percentage of cookie_c values that are correct and a smaller number that are not.

Is there anyway to offer a hint to the auto-extractor to make this not happen?

[stephanefotso]

Yes of course! your can create your search time field extraction with props.conf edit.
Let's suppose that The field should be extracted from events related to the accesslogs sourcetype.
1. Create your own props.conf file, and put it in $SPLUNK_HOME/etc/apps/yourappname/local.
2. configure your stanza like this:

[acceslogs]
EXTRACT-cookiec = cookie_c=(?<cookie_c>[^"]+)

1. and restart splunk