Extracting Logs at Whitespace

[_gkollias]

Right now, I have a name=value|name=value| format for some logs.

But one problem is the Splunk auto-extract for that data stops working at white-space when there's no quotes around the data

For example, the field Message:

For one of the Failures, Message should equal "Message=Failed to deploy configurations to aliases [CITST:serverName,CITST:serverName,CITST:serverName,]"

But when I see it in results I just have Message=Failed. There's way to do it in the search, but defining some props for that would help out.

Does anyone know what I could add to my props.conf to make this successful?

Thank you!

[okrabbe_splunk · Accepted solution]

There are many different ways to do this. You could edit props.conf and defint an EXTRACT for the sourcetype to manually extract the field.

Probably the easiest though would be to try to first use the Splunk web UI to do the field extraction.

http://docs.splunk.com/Documentation/Splunk/6.0.1/Knowledge/Managesearch-timefieldextractions

[_gkollias]

Awesome I'll try it out. Thank you very much for your help!

[okrabbe_splunk]

Yup. You do not want anyway whitespace between extract and eisci.

something like:
EXTRACT-eisci = message="(?[^"]+)"

You may need to restart after you update this.

[_gkollias]

so do something like

EXTRACT - eisci = ?