Splunk Search

How to stop field extractions from within path and url fields

proylea
Contributor

How do you stop Splunk pulling fields out of paths and url fields like this one

path="/portal.php?mod=portalcp&ac=comment&op=reply&aid=561514&infloat=yes&handlekey=c_&referer=http%3A%2F%2Fwww.backchina.com%2Fportal.php%3Fmod%3Dcomment%26id%3D561514%26idtype%3Daid%26page%3D2&inajax=1&ajaxtarget=fwin_content_c_"

I've extracted the path field in props.conf and it works, but Splunk also pulls out every other keyvalue pair
mod=
ac=
etc etc etc

These fields are turning up in Splunk ES as weird user names and http_method values.

0 Karma
1 Solution

cpetterborg
SplunkTrust
SplunkTrust

You can probably do it with setting KV_MODE=none in the props.conf file for the sourcetype (or source, whichever works for you case). This was already answered this way in:

https://answers.splunk.com/answers/74720/disable-automatic-field-extraction.html

It seemed to work for the person in that posting.

View solution in original post

cpetterborg
SplunkTrust
SplunkTrust

You can probably do it with setting KV_MODE=none in the props.conf file for the sourcetype (or source, whichever works for you case). This was already answered this way in:

https://answers.splunk.com/answers/74720/disable-automatic-field-extraction.html

It seemed to work for the person in that posting.

proylea
Contributor

awesome thanks cp works good 🙂

0 Karma

proylea
Contributor

Thanks cp all sorted

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

Not that I'm fishing for the karma points, but if you accept this answer, then others will know that this question has been answered satisfactorily. Thanks!! 🙂

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...