Getting Data In

Incomplete field value

swetar
New Member

Hi,
I am passing a log file . The field values for message field is incomplete. Also the Message field has many pattern.
Can any one suggest me. How can i handle this in prof.conf

Log file
Name=ABC
PLACE=XXX
MESSAGE=PQRS is a valid :CCCC is true
CATEGORY=ZEB
Output

NAME=ABC
PLACE=XXX
MESSAGE=PQRS
CATEGORY=ZEB

Thanks

0 Karma

woodcock
Esteemed Legend

Use a transform like this:

(?<_KEY_1>[^=\s]+)=(?<_VAL_1>[^=]+)(?=$|\s+[^=\s]+=)

See here:
https://regex101.com/r/4vV2LN/1

0 Karma

somesoni2
Revered Legend

YOu probably need to setup custom field extractions for this, specially for the fields which have multiple words, similar to this

https://regex101.com/r/ItDDD6/1

Also, if you've control over how the logging is done, then you could update your logger to log the field value within double quotes so that Splunk can automatically do the full field extraction.

0 Karma
Get Updates on the Splunk Community!

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security ...

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...