Dealing with spaces in fields

[kjonzeatgmaildo]

I am sending events into Splunk using a tool that has a notification engine. The notification engine only allows me to set a value which then extracts the message attribute for forwarding.

For instance I set the value "$reason" and what gets sent for that value can be one or many words. When the value sent is more than one word, Splunk will only parse the first word. Hence if the field in the syslog message is "event_id=Added registered device for user: jdoe", splunk will show it as "event_id Added". How do I get Splunk to read in the entire message knowing that I can't do anything to adjust the way the source sends it?

[Ayn]

I usually define my own key/value extraction for this. As long as there's a good way of specifying what the key and what the value is this works fine. Something like this:

[my_kv_extract]
REGEX = ([^=]+)="([^"]+)
FORMAT = $1::$2

[grijhwani]

Can you rewrite your message templates to include quotation marks enclosing the token substitutions? For example:

name="Registration Event" event_id="$message" vendor="Extreme Networks" product="NAC" RegistrationType="$type" RegistrationTime="$time" RegistrationMessage="$message" RegistrationSource="$source"

[somesoni2]

Will it be possible for you to change the field delimiter from space to comma?

[kjonzeatgmaildo]

That was my first thought as well. I tried it and it had no effect what-so-ever. I doesn't seem as if I can do aything about how the events are sent; I need to do something on the Splunk side to make it understand that "$message" can be multiple words with spaces. Is this possible?

[kjonzeatgmaildo]

There are actually many fields all of which are separated by spaces. Actually here's what one looks like

name="Registration Event" event_id=$message vendor="Extreme Networks" product=NAC RegistrationType=$type RegistrationTime=$time RegistrationMessage=$message RegistrationSource=$source

If the answer from any of these attributes is more than one word, Splunk ignores it even though it's in the raw message that Splunk receives.

[somesoni2]

do your generated log file have only one field or multiple? If multiple fields, how are multiple filed separated?