Splunk Search

How to search and filter by a field that contains spaces?

teknet7
Engager

Hello Team,

I could see a lot of discussions on this forum, but none solving my issue.

I have a log with content like this:

field number1: value1, Application Server=running, Database Server=running

When I try these searches:
Server="running" works fine, but with 'Application Server'="running" or "Application Server"="running" it's not. How can I filter by value of a field which has a space? I need to have logs with Application Server running (not Database Server running).

Thanks,
Michal

JL99
Explorer

You should able to do that with enclosing your field name with dollar sign ($)

$Application Server$="running"


Refer to: https://community.splunk.com/t5/Splunk-Search/Search-field-names-with-spaces-in-map-command-inner-se...

0 Karma

jsven7
Communicator

If you're looking for events with Server fields containing "running bunny", this works for me:

Server=*"running bunny"*

sjohnson_splunk
Splunk Employee
Splunk Employee

When you view the raw events in verbose search mode you should see the field names. What is the field name? If it is just "server" you should consider creating either an EXTRACT or REPORT in the props.conf for that source or sourcetype.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...