Splunk Search

Quoted escape characters when searching a field

JoeSco27
Communicator

"2013-12-19 11:13:23", "[INFO]", "30927", "MainProcess", "SSMITH"

My data is coming into Splunk in this format, and when I select to look at it in raw form this is an example of one of my logs. The issue I am having is that when I want to search for a field I have to search for it in the following way or it wont show up:

levelname="\"[INFO]\""

I need the initial quotes around each field because some of the fields may have commas in them and the delimiter is also a comma. Is there a config I can use so I don't have to escape the quotes when searching for a field value? Or any advice besides changing the delimiter to fix the issue?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

This could work for as an easiest options, but you need to include it in every search you make (as compare to search time field extraction suggested by @richgalloway, which you just configure once).

<your search starter index=blah sourcetype=blah> | replace "\"*\"" with "*" |<...rest of your search>

This will replace all the instance of '"value"' with 'value'.

richgalloway
SplunkTrust
SplunkTrust

Use a REGEX to parse the data. Put this in your transforms.conf file instead of DELIMS:

[<transformName>]
REGEX = \"(?<EventTime>.*?)\",\s\"(?<Level>.*?)\",\s\"(?<Field3>.*?)\",\s\"(?<Field4>.*?)\",\s\"(?<Field5>.*?)\"

---
If this reply helps you, Karma would be appreciated.
0 Karma

lukejadamec
Super Champion

This is a search time field extraction in a config file (what you asked for). I'm not sure how to configure this to apply to only this field, but it would not surprise me if it's possible.

0 Karma

JoeSco27
Communicator

I appreciate the quick response, but I would prefer not to have to do a index-time field extraction. Additionally, this is just a piece of my log, I have an additional 20 or so fields. Does anyone know of any other way around this? I could use this as a last resort but would rather not have to.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...