I'm new to splunk and I'm trying to import some data from a database that I'd like to have indexed by Splunk. I have a script that returns the info from the database in column name = value pairs. However, some of the column names and values have spaces in them, which seem to mess with Splunk's ability to extract field names. Putting quotes around the column name and value didn't work. Replacing spaces with underscores works, but that is not an ideal solution. Using the MySQL Connector app I'm able to view the database as it is, but I can't maintain historical data. So how does Splunk decide what is a field and what isn't beyond simple field=value pairs? Can I do something so that it will accept spaces in the field names from the script data? Can I change the way my script outputs data (currently columnname=value for every row) so that it captures the column name and values properly? Is there a way to use the MySQL Connector app for monitoring changes in my database? Thanks ... View more