Splunk Search

Iterative fields with spaces in values

michaelbrunetto
New Member

I'm having trouble with the way Splunk parses some of my logs which has field=value pairs that have values with unquoted values with spaces. Example:
_raw = some|segmented|text|field1=value1 field2=value2 field3=a third value field4=my forth value field5=value5 field6=one more with spaces

I've already broken it up so I get the following field:
GENERIC = field1=value1 field2=value2 field3=a third value field4=my forth value field5=value5 field6=one more with spaces

The problem is Splunks parsing automatically determines this:
field1=value1
field2=value2
field3=a
field4=my
field5=value5
field6=one

should be:
field1=value1
field2=value2
field3=a third value
field4=my forth value
field5=value5
field6=one more with spaces

I've tried using regexes with rex, but the problem is that all of these fields are optional, and I don't necessarily have a complete list of fields yet.
Most recently I've been trying to use sed to put a \n in front of anything with an = sign after it, but that hasn't worked so well.

Good news is, from everything I can tell, the fields don't have spaces in them.
{edited for formatting}

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You could build a regex that looks for field2= or $ after extracting field1=[^=]+, that way it should walk right up to the next field name but not include it.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...