I am having a problem with the CLEAN_KEYS property.
Here is my raw message that gets appended to my log file. Note: the keys are consist of just numeric values.
Raw Message:
8=FIX.4.4,9=125,35=D,56=BLPUS,49=FMRFIBOOM,52=20120502-08:43:02,34=5662,54=1,55=GOOG3,38=15200,44=20,11=Order1,21=2,60=20120502-08:43:02,40=2,10=219,
It appears that the fields do not get recognized as they are all numeric.
We set the CLEAN_KEYS property to false expecting that we Splunk would successfully extract the numeric values (8, 9, 56 etc) as fields. However, it does not do this. Are our expectations wrong?
We have noted that if we change the message to include an character after the numeric value, i.e.
8a=FIX.4.4,9b=125,35c=D,56d=BLPUS,49e=FMRFIBOOM,etc. - splunk will recognize a, b, c as fields
... View more