- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I want to index fieldName which contains square brackets
Hi,
I want to index a fieldName which contains square brackets
Below is the key-value pair format I have and splunk is not indexing keys value which consists []
eg: root[60]_level[5]=value
Any suggestions?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


Square brackets are not allowed in field names. If Splunk encounters such a field name, it will convert the unacceptable characters into underscores.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for the response.
But as I mentioned earlier splunk is logging as root[60]_level[5]=value
[] are not converted to underscores.
Do I need to do any property changes for that ?
Suppose the conversion is done and my key is replaced with double underscores like below "root_60__level_5_=value"
Does splunk honurs double underscore and still index the key "root_60__level_5_"?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @pallavikarpaklu , could you please give example of what is the actual key-value pair in log and what Splunk is indexing ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sure. Below is the sample logger with two keys "root[60]_level[5]" and "root_string".
2020-10-07 17:50:04,208 - INFO - root[60]_level[5]=value, root_string=value
root_string - This key is indexed
root[60]_level[5] - This key is not indexed.
I am open to try any kind of key transformations but I want the key to be indexed. Please suggest.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
hi @pallavikarpaklu , could you please also provide the current props.conf/transforms.conf stanza you are using for indexing this data.
