How to avoid extracting fields from quoted values?

[krisreeves]

We've noticed that key=value pairs inside a quoted value get extracted too. For example, with an event like foo="bar=baz", the field foo will be extracted with the value bar=baz, but also the field bar will be extracted with the value baz. Is there a way to disable this behavior? (Splunk Enterprise 6.5.4)

This sometimes creates a problem when logging things like URLs that have query strings; if a query string contains a key that has the same name as another field in the event, the extraction of that query string value will override the value of the field we want (possibly later in the line)

[woodcock]

You should set KV_MODE = none to turn off this capability and then create your own unanchored RegEx as a REPORT- search-time extraction to do the same thing, but in a way that you control.

[krisreeves]

This is pretty unfortunate, but I haven't found a better solution 😕

[thambisetty · Accepted solution]

Hi @krisreeves,

Automatic key-value field extraction is a search-time field extraction configuration that uses the KV_MODE attribute to automatically extract fields for events associated with a specific host, source, or source type. Configure automatic key-value field extractions by finding or creating the appropriate stanza in props.conf. You can find props.conf in $SPLUNK_HOME/etc/system/local/ or your own custom app directory in $SPLUNK_HOME/etc/apps/.

so set KV_MODE=none in props.conf to avoid auto kv extractions and write a custom parser for your events either index/search time.