Thank you. That was what was missing ... View more

This solution works but it wasn't exactly what I wanted. In this post this person asked the same and its looks like there is no solution. How to escape equal signs (=) in key value data? - Splunk Community ... View more

Hi Woodcock, I'm having the same problem that HELGE mentioned. I have created my own KV_MODE as you gave in the solution but I still get the same error. Can you confirm that even if I have created my own KV_MODE IT IS NOT POSSIBLE to skip the equal symbol (=)? (Splunk keeps creating different fields whenever it finds an = inside the value). ... View more

Sorry is the first time I am doing this. Could you explain it with more detail? Where should I add EXTRACT? as you said in the props.conf but exactly where and with what parameters? ... View more