Getting Data In

Default delimiters for key value extraction

helge
Builder

I have been sending key value data like the following to Splunk:

metric1=1.0 metric2=22 metric3="Some string"

I have manually wrapped values that may contain spaces in double quotes. I would like to formalize this and write a routine that automatically wraps values in quotes when necessary. To do that I need to know what the default delimiters are. I could not find a list anywhere.

Delimiters between key and value: anything else in addition to the equal sign (=)?

Delimiters between pairs: anything else in addition to the space ( )?

Tags (2)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Comma is also one of the default delimiters between pairs. If your value contains a comma, it should be in double quotes. See this run anywhere example.

|gentimes start=-1 | eval _raw="First=Example Last=LastName,Email=Example,LastName@gmail.com Email2=\"Example,LastName@gmail.com\"" | table _raw | extract

This should be full list (per my knowledge)

space
comma
semicolon
pipe
ampersand
tab
new line

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

If you're really looking for something cleanly defined, I would not rely on heuristic key-value detection, but would instead output the event as structured JSON. Splunk can be set to auto extract those, and JSON deals with cases like quoting and embedding delimiters in values.

helge
Builder

This really should be documented by Splunk.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

I mean that if you're looking for a clear definition, you should use something with a clear standard definition, rather than something that is arbitrary, undocumented, and may change from version to version.

madavies
Engager

Interesting point/approach. Would be nice to have some more details from the Splunk team on this.

0 Karma

helge
Builder

Do you mean there is no static list of default delimiters? That seems unlikely.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Comma is also one of the default delimiters between pairs. If your value contains a comma, it should be in double quotes. See this run anywhere example.

|gentimes start=-1 | eval _raw="First=Example Last=LastName,Email=Example,LastName@gmail.com Email2=\"Example,LastName@gmail.com\"" | table _raw | extract

This should be full list (per my knowledge)

space
comma
semicolon
pipe
ampersand
tab
new line

helge
Builder

I am looking for a full list of delimiters.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Same story with semicolons, pipes, newlines, tabs, ...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...