filed ignore textx within " "

[patelmc]

Hello, 

I see following in _raw.  However, when I run search with table or fields it does not display text within double quote despite its in _raw.  "ptp-slave" does not get displayed as a value for field title. it only displays PTP State is ptp-listeining, should be. 

2022-01-25 21:47:57.047, id="12342ee7c-757e-71ec-1090-777c841f0000", version="15119", title="PTP State is ptp-listening, should be "ptp-slave"", state="OPEN", severity="CRITICAL", priority="MEDIUM", --> there are more fields after this. 

How can get entire test to be displayed. 

[ITWhisperer]

Embedded double quotes would normally be escaped, but since they aren't, you could use a look ahead to use another pattern to find the end of the field, e.g. ", the caveat being that if you have an embedded ", this will also fail to extract the field correctly

| makeresults
| eval _raw="2022-01-25 21:47:57.047, id=\"12342ee7c-757e-71ec-1090-777c841f0000\", version=\"15119\", title=\"PTP State is ptp-listening, should be \"ptp-slave\"\", state=\"OPEN\", severity=\"CRITICAL\", priority=\"MEDIUM\""
| rex max_match=0 "=\"(?<field>.+?)(?=\"(,|$))"

[patelmc]

Thanks, but it can be risky as you mentioned. 

Was hoping Splunk should have ignore internal " ". 

Could be a bug?

[ITWhisperer]

It is not a bug, at least not a bug in splunk - how would splunk know whether a double quote was an internal one or not?

The bug (if you want to call it that) lies with the application generating the message. The quoted string needs to escape embedded delimiters, double quotes in this instance, but if the string was enclosed in single quotes instead, then any embedded single quotes (including apostrophes) would need to be escaped.

Depending on how you are extracting the fields, you may be able to reduce the risk even further, but extracting one field at a time and using the name of the following field as part of the end marker for the field.