I have a dataset like this :
field1=XXXX YYYYY-field2=ZZZZZZ:AAAAAA-field3=BBBBBB-field4=CCCCCC DDDDDDDD
Now after importing my data in splunk I am not getting the correct data in the fields
When I did like this :
field1="XXXX YYYYY" field2="ZZZZZZ:AAAAAA" field3="BBBBBB" field4="CCCCCC DDDDDDDD"
Then it worked, but in the raw log manually it is not possible to decorate the data as it is big in size
Can this type of formation can be made before importing the data into SPLUNK ?
Thanks in advance
I would make a field transformation, with a regex, that seperates the fields by "-"...
I'm not an expert in regex, but you need to search something like that :