[Solved] How to extract fields with a space in a field name?

[AlexeySh]

[edit - a workaround was found in the comments]

Hello,

We try to export VMware inventory to Splunk. A raw Splunk event looks like this:

VM="Template Debian 9", Powerstate="poweredOn", IP Address="100.100.100.100", Cluster="My Cluster Name", VM ID="12345", ... etc.

Splunk extracts perfectly well all fields without spaces in field name, like VM, Cluster, Powerstate, etc. But it can't extract the fields with spaces, like IP Address, VM ID, etc.; they are visible only in raw data, but not as fields.

We tried to use a rex command like that one:

rex field="IP Address" mode=sed "s/ /_/g"

but we didn't succeed.

Do you have any idea how we could extract these fields?

Thanks for the help.

[PowerPacked]

Hi

Check with CLEAN_KEYS setting in props.conf, if it can help.

Thanks

[richgalloway]

What are the props.conf settings for the sourcetype you are using for the data?
Splunk will parse key=value data quite well with the default settings, but does not handle embedded spaces without customization.

[AlexeySh]

Actually we use DB Connect app to perform a query like "SELECT * FROM ".

And now you made me think that we can change field name directly in the DB Connect query!

Sometime you just need a second brain to think 🙂

[richgalloway]

Yes, you can. If that solves your problem then please come back to answer the question and accept it to help future readers.