Splunk Search
Highlighted

Is there a way to extract a field that contains the delimiter within it?

Path Finder

I have a file that is delimited by " so that is what I am using to extract the fields, however, some events have a field that contains the delimiter itself within it. How do I go about extracting this field, without Splunk breaking that field into several other fields?

Sample:
"srcip" "authuser" "timestamp" "bytestoclient" "reqline" "statuscode" "mediatype" "categories" "replevel" "virusname" "block_res" "Policy" "Proxy Port"
"1.1.1.1" "Joe123" "[23/Nov/2014:23:30:05 -0500]" "1511" "GET http://www.nbcudigitaladops.com/hosted/global.js HTTP/1.1" "200" "text/javascript" "Internet Services" "Unverified" "" "0" "AIU" "9090"
"1.2.2.8" "Jane123" "[25/Nov/2014:23:30:41 -0500]" "438" "GET http://www.bing.com/fd/ls/l?IG=de256505264d4eb181a8498ff8a3da90&Type=Event.PPT&DATA={"S":1256,"E":17... HTTP/1.1" "200" "image/gif" "Search Engines" "Minimal Risk" "" "0" "AIU" "9090"

Highlighted

Re: Is there a way to extract a field that contains the delimiter within it?

SplunkTrust
SplunkTrust

It looks to me, based on your sample events, that space is the delimiter and quotation marks enclose each field.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

Highlighted

Re: Is there a way to extract a field that contains the delimiter within it?

Path Finder

Yes, I've also tried space, however, it is also included within some of the fields:
"GET http://www
"Search Engines"
"Minimal Risk"

0 Karma
Highlighted

Re: Is there a way to extract a field that contains the delimiter within it?

New Member

Appreciate if you share the query format .

0 Karma
Highlighted

Re: Is there a way to extract a field that contains the delimiter within it?

Path Finder

Thanks, I actually went back and changed the delimiter back to space and I had to change the Character to use for quotes to Double Quotes instead of Auto. That seemed to do the trick.

Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.