handle ' as field delimiter in logs

[dominiquevocat]

I have logs that are generally fine and log in key=value pairs - however it uses a strage format
Sample:
rmIP='195.182.60.200'
splunk won't recognize it i.e. the field content in splunk is '195.182.60.200' as oposed to 195.182.60.200

how would i best go about it?

[sowings]

You could use an eval-based rule (see "EVAL" in props.conf documentation), to invoke 'trim', keeping the old field name:


EVAL-rmIP = trim(rmIP, "'")


[emechler_splunk · Accepted solution]

You'll probably want to use REGEX / FORMAT for this. This regex might need some tuning, but it should handle the following cases:

rmIP='195.182.60.200'
rmIP="195.182.60.200"
rmIP=195.182.60.200

In transforms.conf:

[strip-quotes]
REGEX = ([^ ]+)=(?:\'|\")?([^\'\"\s]+)(?:\'|\")?
FORMAT = $1::$2

In props.conf:

[my_sourcetype]
REPORT-strip-quotes = strip-quotes

[dominiquevocat]

I ended up doing regex to extract the information into (CIM like) normalized fields. But this would have worked nicely and seems a good solution for most encountering this situation. It would be nice if splunk's internal regex would also automatically recognize ' as field content delimiter.