Splunk Search

How to avoid extracting fields from quoted values?

krisreeves
Path Finder

We've noticed that key=value pairs inside a quoted value get extracted too. For example, with an event like foo="bar=baz", the field foo will be extracted with the value bar=baz, but also the field bar will be extracted with the value baz. Is there a way to disable this behavior? (Splunk Enterprise 6.5.4)

This sometimes creates a problem when logging things like URLs that have query strings; if a query string contains a key that has the same name as another field in the event, the extraction of that query string value will override the value of the field we want (possibly later in the line)

0 Karma
1 Solution

thambisetty
Super Champion

Hi @krisreeves,

Automatic key-value field extraction is a search-time field extraction configuration that uses the KV_MODE attribute to automatically extract fields for events associated with a specific host, source, or source type. Configure automatic key-value field extractions by finding or creating the appropriate stanza in props.conf. You can find props.conf in $SPLUNK_HOME/etc/system/local/ or your own custom app directory in $SPLUNK_HOME/etc/apps/.

so set KV_MODE=none in props.conf to avoid auto kv extractions and write a custom parser for your events either index/search time.

————————————
If this helps, give a like below.

View solution in original post

woodcock
Esteemed Legend

You should set KV_MODE = none to turn off this capability and then create your own unanchored RegEx as a REPORT- search-time extraction to do the same thing, but in a way that you control.

krisreeves
Path Finder

This is pretty unfortunate, but I haven't found a better solution 😕

0 Karma

thambisetty
Super Champion

Hi @krisreeves,

Automatic key-value field extraction is a search-time field extraction configuration that uses the KV_MODE attribute to automatically extract fields for events associated with a specific host, source, or source type. Configure automatic key-value field extractions by finding or creating the appropriate stanza in props.conf. You can find props.conf in $SPLUNK_HOME/etc/system/local/ or your own custom app directory in $SPLUNK_HOME/etc/apps/.

so set KV_MODE=none in props.conf to avoid auto kv extractions and write a custom parser for your events either index/search time.

————————————
If this helps, give a like below.

View solution in original post

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!