Splunk Search

Dealing with spaces in fields

kjonzeatgmaildo
New Member

I am sending events into Splunk using a tool that has a notification engine. The notification engine only allows me to set a value which then extracts the message attribute for forwarding.

For instance I set the value "$reason" and what gets sent for that value can be one or many words. When the value sent is more than one word, Splunk will only parse the first word. Hence if the field in the syslog message is "event_id=Added registered device for user: jdoe", splunk will show it as "event_id Added". How do I get Splunk to read in the entire message knowing that I can't do anything to adjust the way the source sends it?

0 Karma

Ayn
Legend

I usually define my own key/value extraction for this. As long as there's a good way of specifying what the key and what the value is this works fine. Something like this:

[my_kv_extract]
REGEX = ([^=]+)="([^"]+)
FORMAT = $1::$2
0 Karma

grijhwani
Motivator

Can you rewrite your message templates to include quotation marks enclosing the token substitutions? For example:

name="Registration Event" event_id="$message" vendor="Extreme Networks" product="NAC" RegistrationType="$type" RegistrationTime="$time" RegistrationMessage="$message" RegistrationSource="$source"
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Will it be possible for you to change the field delimiter from space to comma?

0 Karma

kjonzeatgmaildo
New Member

That was my first thought as well. I tried it and it had no effect what-so-ever. I doesn't seem as if I can do aything about how the events are sent; I need to do something on the Splunk side to make it understand that "$message" can be multiple words with spaces. Is this possible?

0 Karma

kjonzeatgmaildo
New Member

There are actually many fields all of which are separated by spaces. Actually here's what one looks like

name="Registration Event" event_id=$message vendor="Extreme Networks" product=NAC RegistrationType=$type RegistrationTime=$time RegistrationMessage=$message RegistrationSource=$source

If the answer from any of these attributes is more than one word, Splunk ignores it even though it's in the raw message that Splunk receives.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

do your generated log file have only one field or multiple? If multiple fields, how are multiple filed separated?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...