×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Ask a Question
Markus
Engager
Member since: ‎10-19-2023
‎10-19-2023
Community Statistics
Posts 2
Solutions 0
Karma Given 1
Karma Received 1
Member Since ‎10-19-2023
View All

Re: How to forward separate keys and values from a...

by in Splunk Search
‎10-19-2023 07:55 AM
1 Karma
‎10-19-2023 07:55 AM
1 Karma
I go with the default indexing of raw. However, I had to change my output from key1=value1,key2=value2,key3=value3 (no space after comma) into key1=value1, key2=value2, key3=value3 (space after comma) ... View more

How to forward separate keys and values from a Spl...

by in Splunk Search
‎10-19-2023 06:51 AM
‎10-19-2023 06:51 AM
I use a PowerShell script in a Splunk forwarder that sends data with Write-Output $line Splunk receives this data in the _raw field.   How shall a PowerShell script write key-value pairs, so that for Splunk there are separate keys and values instead of _raw? ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎10-19-2023 11:17 AM
Karma from
View All
Karma given to
View All