I have logs that are generally fine and log in key=value pairs - however it uses a strage format
Sample:
rmIP='195.182.60.200'
splunk won't recognize it i.e. the field content in splunk is '195.182.60.200' as oposed to 195.182.60.200
how would i best go about it?
You'll probably want to use REGEX / FORMAT for this. This regex might need some tuning, but it should handle the following cases:
rmIP='195.182.60.200'
rmIP="195.182.60.200"
rmIP=195.182.60.200
In transforms.conf:
[strip-quotes]
REGEX = ([^ ]+)=(?:\'|\")?([^\'\"\s]+)(?:\'|\")?
FORMAT = $1::$2
In props.conf:
[my_sourcetype]
REPORT-strip-quotes = strip-quotes
You could use an eval-based rule (see "EVAL" in props.conf documentation), to invoke 'trim', keeping the old field name:
EVAL-rmIP = trim(rmIP, "'")
You'll probably want to use REGEX / FORMAT for this. This regex might need some tuning, but it should handle the following cases:
rmIP='195.182.60.200'
rmIP="195.182.60.200"
rmIP=195.182.60.200
In transforms.conf:
[strip-quotes]
REGEX = ([^ ]+)=(?:\'|\")?([^\'\"\s]+)(?:\'|\")?
FORMAT = $1::$2
In props.conf:
[my_sourcetype]
REPORT-strip-quotes = strip-quotes
I ended up doing regex to extract the information into (CIM like) normalized fields. But this would have worked nicely and seems a good solution for most encountering this situation. It would be nice if splunk's internal regex would also automatically recognize ' as field content delimiter.