Splunk Search

Why am I unable to extract values from the following logs?

saifullakhalid
Explorer

Every time I try extracting values for platform, testNames, testId and experience , I always get "\"

Can you please suggest some query to extract these values.

Log format :

time="2018-12-20T22:00:54.868Z", message="bctest batch platform=\"Target\" testNames=\"fitBCTest\",[testName=\"fitBCTest\",testId=\"22323:0:0,\",experience=\"\"]", level="INFO"

Expected Output:

platform= Target
testNames= fitBCTest
testId= 22323:0:0
experience=\
Tags (2)
0 Karma

alonsocaio
Contributor

Were you trying to extract these fields using regex?

0 Karma

briancronrath
Contributor

In your props.conf you should specify KV_MODE = auto_escaped for a sourcetype like this to extract properly

0 Karma
Get Updates on the Splunk Community!

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...