Splunk Search

[Solved] How to extract fields with a space in a field name?

AlexeySh
Communicator

[edit - a workaround was found in the comments]

Hello,

We try to export VMware inventory to Splunk. A raw Splunk event looks like this:

VM="Template Debian 9", Powerstate="poweredOn", IP Address="100.100.100.100", Cluster="My Cluster Name", VM ID="12345", ... etc.

Splunk extracts perfectly well all fields without spaces in field name, like VM, Cluster, Powerstate, etc. But it can't extract the fields with spaces, like IP Address, VM ID, etc.; they are visible only in raw data, but not as fields.

We tried to use a rex command like that one:

rex field="IP Address" mode=sed "s/ /_/g"

but we didn't succeed.

Do you have any idea how we could extract these fields?

Thanks for the help.

0 Karma

PowerPacked
Builder

Hi

Check with CLEAN_KEYS setting in props.conf, if it can help.

Thanks

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What are the props.conf settings for the sourcetype you are using for the data?
Splunk will parse key=value data quite well with the default settings, but does not handle embedded spaces without customization.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

AlexeySh
Communicator

Actually we use DB Connect app to perform a query like "SELECT * FROM ".

And now you made me think that we can change field name directly in the DB Connect query!

Sometime you just need a second brain to think 🙂

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes, you can. If that solves your problem then please come back to answer the question and accept it to help future readers.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.