Splunk Search

Support for LogEntries KVP format?

RamG
New Member

Splunk would not automatically extract fields from my application log files that have Key-Value Pairs (KVP) delimited with TAB characters.  https://docs.rapid7.com/insightops/json-kvp-parsing

Would Custom Parsing need to be configured on the Splunk Forwarder side?

or is there some other efficient way to get automatic field extraction of KVP data?

Thanks

Ram

Thanks for sharing any document

 

Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Splunk will parse key=value events automatically as well as many other formats.  If it doesn't parse your data automatically then, yes, you will need custom parsing.

Custom parsing is performed on indexers or heavy forwarders - not on universal forwarders (usually).

Why are you referencing a Rapid7 document about parsing on Splunk?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...