I have a field that looks like this:
I put in a stanza in transforms that looks like this:
Then I run a search like this:
index=something | extract star_equals
That works great for everything except the first key/value pair.
When splunk first does it's auto extract, it thinks
key1 has a value of value1*key2=value2*...
When I run the extract command, the value for key1 does not get overwritten.
I can't turn off splunk auto extractions (too much other stuff would break).
If I put in a "field - key1" before the extract, eveything works great, but I won't know what the first key will be, so that's not an option.
Any other ideas?
Can you include the character that is before the first field in DELIMS?
if you have something like this:
Aug 30 12:34:54 "key1=value1*key2=value2*key3=value3"
then you can extract the keys as a single field.
From this field, you can then extract your keys.
Thanks for the idea,
I'm not really following what you meant in the second part (this field is a subpart of the entire event). I do have this part extracted into a field. Are you talking about a new section in the transforms.prop file?