Splunk Search

Events with Tab Delimited values

akshatj2
Path Finder

Hi All,

I have some logs which are mostly tab delimited I used props and transforms to set up the delimited extractions but in a few logs we have back slash("\") as a field value. Looks like Splunk is unable to handle the same with delimited extractions.

has anyone faced similar issue earlier or if there is any solution for the same.

Example Below:

Sample Logs:
Log1: Hostname abc \ xyz
Log2: Hostname abc domain\username xyz

Currently with delimited extraction: I am getting below values
Log 1:
Field 1: Hostname
Field 2:abc
Field 3: \

xyz

Log 2:
Field 1: Hostname
Field 2:abc
Field 3: domain\username
Field 4: xyz

Tags (1)
0 Karma

Sukisen1981
Champion

you need 3 backslashes
somethinf like this

[source::blah blah]
SEDCMD-removebackslsh = s/\\//g

test on the web first

   | makeresults 
         |  eval x="Hostname abc \ xyz" 

     | rex mode=sed field=x "s/\\\//g"
0 Karma

Sukisen1981
Champion

hi @ akshatj2
Please accept the answer if it helped resolve your issue, or let us know what more is needed to resolve your issue

0 Karma

akshatj2
Path Finder

Hi Sukisen

Thank you for suggestion but my we do not want to remove the backslash available. We wanted to parse that backslash as a filed value using delimiter. Looks like I have found a solution though I am just testing it and should post the answer soon.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!