Events with Tab Delimited values

[akshatj2]

Hi All,

I have some logs which are mostly tab delimited I used props and transforms to set up the delimited extractions but in a few logs we have back slash("\") as a field value. Looks like Splunk is unable to handle the same with delimited extractions.

has anyone faced similar issue earlier or if there is any solution for the same.

Example Below:

Sample Logs:
Log1: Hostname abc \ xyz
Log2: Hostname abc domain\username xyz

Currently with delimited extraction: I am getting below values
Log 1:
Field 1: Hostname
Field 2:abc
Field 3: \

xyz

Log 2:
Field 1: Hostname
Field 2:abc
Field 3: domain\username
Field 4: xyz

[Sukisen1981]

you need 3 backslashes
somethinf like this

[source::blah blah]
SEDCMD-removebackslsh = s/\\//g

test on the web first

   | makeresults 
         |  eval x="Hostname abc \ xyz" 

     | rex mode=sed field=x "s/\\\//g"

[Sukisen1981]

hi @ akshatj2
Please accept the answer if it helped resolve your issue, or let us know what more is needed to resolve your issue

[akshatj2]

Hi Sukisen

Thank you for suggestion but my we do not want to remove the backslash available. We wanted to parse that backslash as a filed value using delimiter. Looks like I have found a solution though I am just testing it and should post the answer soon.