"2013-12-19 11:13:23", "[INFO]", "30927", "MainProcess", "SSMITH"
My data is coming into Splunk in this format, and when I select to look at it in raw form this is an example of one of my logs. The issue I am having is that when I want to search for a field I have to search for it in the following way or it wont show up:
levelname="\"[INFO]\""
I need the initial quotes around each field because some of the fields may have commas in them and the delimiter is also a comma. Is there a config I can use so I don't have to escape the quotes when searching for a field value? Or any advice besides changing the delimiter to fix the issue?
This could work for as an easiest options, but you need to include it in every search you make (as compare to search time field extraction suggested by @richgalloway, which you just configure once).
<your search starter index=blah sourcetype=blah> | replace "\"*\"" with "*" |<...rest of your search>
This will replace all the instance of '"value"' with 'value'.
Use a REGEX to parse the data. Put this in your transforms.conf file instead of DELIMS:
[<transformName>]
REGEX = \"(?<EventTime>.*?)\",\s\"(?<Level>.*?)\",\s\"(?<Field3>.*?)\",\s\"(?<Field4>.*?)\",\s\"(?<Field5>.*?)\"
This is a search time field extraction in a config file (what you asked for). I'm not sure how to configure this to apply to only this field, but it would not surprise me if it's possible.
I appreciate the quick response, but I would prefer not to have to do a index-time field extraction. Additionally, this is just a piece of my log, I have an additional 20 or so fields. Does anyone know of any other way around this? I could use this as a last resort but would rather not have to.