Splunk Search

filed ignore textx within " "

patelmc
Explorer

Hello, 

I see following in _raw.  However, when I run search with table or fields it does not display text within double quote despite its in _raw.  "ptp-slave" does not get displayed as a value for field title. it only displays PTP State is ptp-listeining, should be. 

2022-01-25 21:47:57.047, id="12342ee7c-757e-71ec-1090-777c841f0000", version="15119", title="PTP State is ptp-listening, should be "ptp-slave"", state="OPEN", severity="CRITICAL", priority="MEDIUM", --> there are more fields after this. 

How can get entire test to be displayed. 

Labels (1)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Embedded double quotes would normally be escaped, but since they aren't, you could use a look ahead to use another pattern to find the end of the field, e.g. ", the caveat being that if you have an embedded ", this will also fail to extract the field correctly

| makeresults
| eval _raw="2022-01-25 21:47:57.047, id=\"12342ee7c-757e-71ec-1090-777c841f0000\", version=\"15119\", title=\"PTP State is ptp-listening, should be \"ptp-slave\"\", state=\"OPEN\", severity=\"CRITICAL\", priority=\"MEDIUM\""
| rex max_match=0 "=\"(?<field>.+?)(?=\"(,|$))"
0 Karma

patelmc
Explorer

Thanks, but it can be risky as you mentioned. 

Was hoping Splunk should have ignore internal " ". 

Could be a bug?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It is not a bug, at least not a bug in splunk - how would splunk know whether a double quote was an internal one or not?

The bug (if you want to call it that) lies with the application generating the message. The quoted string needs to escape embedded delimiters, double quotes in this instance, but if the string was enclosed in single quotes instead, then any embedded single quotes (including apostrophes) would need to be escaped.

Depending on how you are extracting the fields, you may be able to reduce the risk even further, but extracting one field at a time and using the name of the following field as part of the end marker for the field.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...