Splunk Search

How to stop field extractions from within path and url fields

proylea
Contributor

How do you stop Splunk pulling fields out of paths and url fields like this one

path="/portal.php?mod=portalcp&ac=comment&op=reply&aid=561514&infloat=yes&handlekey=c_&referer=http%3A%2F%2Fwww.backchina.com%2Fportal.php%3Fmod%3Dcomment%26id%3D561514%26idtype%3Daid%26page%3D2&inajax=1&ajaxtarget=fwin_content_c_"

I've extracted the path field in props.conf and it works, but Splunk also pulls out every other keyvalue pair
mod=
ac=
etc etc etc

These fields are turning up in Splunk ES as weird user names and http_method values.

0 Karma
1 Solution

cpetterborg
SplunkTrust
SplunkTrust

You can probably do it with setting KV_MODE=none in the props.conf file for the sourcetype (or source, whichever works for you case). This was already answered this way in:

https://answers.splunk.com/answers/74720/disable-automatic-field-extraction.html

It seemed to work for the person in that posting.

View solution in original post

cpetterborg
SplunkTrust
SplunkTrust

You can probably do it with setting KV_MODE=none in the props.conf file for the sourcetype (or source, whichever works for you case). This was already answered this way in:

https://answers.splunk.com/answers/74720/disable-automatic-field-extraction.html

It seemed to work for the person in that posting.

proylea
Contributor

awesome thanks cp works good 🙂

0 Karma

proylea
Contributor

Thanks cp all sorted

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

Not that I'm fishing for the karma points, but if you accept this answer, then others will know that this question has been answered satisfactorily. Thanks!! 🙂

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

<P style=" text-align: center; "><span class="lia-inline-image-display-wrapper lia-image-align-center" ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

<FONT size="5"><FONT size="5" color="#FF00FF">Get the latest news and updates from the Splunk Community ...