Extracting data out of fields correctly - Splunk Community

Splunk Search

Hi,

I have a dataset like this :

field1=XXXX YYYYY-field2=ZZZZZZ:AAAAAA-field3=BBBBBB-field4=CCCCCC DDDDDDDD

Now after importing my data in splunk I am not getting the correct data in the fields

When I did like this :
field1="XXXX YYYYY" field2="ZZZZZZ:AAAAAA" field3="BBBBBB" field4="CCCCCC DDDDDDDD"

Then it worked, but in the raw log manually it is not possible to decorate the data as it is big in size

Can this type of formation can be made before importing the data into SPLUNK ?

Thanks in advance

I would make a field transformation, with a regex, that seperates the fields by "-"...

I'm not an expert in regex, but you need to search something like that :
(?P[^-]+)-(?P[^-]+)...

Get Updates on the Splunk Community!

Vibe-coding, AI, and Splunkcraft: Highlights from the .conf26 Builder Bar

If you stopped by the Builder Bar at .conf26, thank you! This year, we brought ...

Thanks for the Memories: .conf26 Took Learning to New Heights

Thank you, Splunk Community, for making .conf26 in Denver one for the books. From packed Splunk University ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...