Splunk Search

kv extract escape keyword

EricPartington
Communicator

using the opsec lea app and noticed that two of the default kv extract key/value pairs werent working for me. The log entry for the relevant key/value was i/f_dir and i/f_name not i_f_dir and i_f_name. I tried to escape the / in the key but that failed as the extracted format was f_name and f_dir.

How do you escape the / in the key?

i///f_dir
i\/fdir
i//f_dir

Here is the attempted setting in props.conf I know its failing as the key displayed in the seach window is not direction and inbound_interface instead its f_name and f_dir.

[if_dir]
#had to modify from i_f_dir
SOURCE_KEY=i//f_dir
REGEX=(.*)
FORMAT=direction::$1

[if_name]
#had to modify from i_f_name
SOURCE_KEY=i//f_name
REGEX=(.*)
FORMAT=inbound_interface::$1
1 Solution

Ledion_Bitincka
Splunk Employee
Splunk Employee

Can you provide an example of a log line? By default during kv extraction splunk replaces non alphanumeric characters in keys with '_' to make working with fields easier.

View solution in original post

0 Karma

EricPartington
Communicator

the new version of the checkpoint binary solves this problem for me. the names of the fields are now named and extracted properly.

thanks for the follow up

Eric

0 Karma

Ledion_Bitincka
Splunk Employee
Splunk Employee

Can you provide an example of a log line? By default during kv extraction splunk replaces non alphanumeric characters in keys with '_' to make working with fields easier.

View solution in original post

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!