Splunk Search

How to extract key value pairs where each value has non-standard "quoters" (ex: foo='bar', dog='cat')?

ccollord
Explorer

Hi,
To make a long story short i have some logs that are key value pairs, like so:

foo="bar" dog="cat" frog="bat"
Unfortunately my Windows logging daemon converts to this:

[hostname] data="foo='bar' dog='cat' frog='bat'"

Splunk is actually handling the extractions just fine, except that each value pair is:
'bar', 'cat', 'bat'
(They have the included single-tick in the value.) Is there an easy way to fix this? From Splunk documentation and a blog post from 2008 i've gathered that the quotation marks around the values are called "quoters" and they are not configurable to be different characters like an apostrophe[1]. What else can i do?

[1] http://blogs.splunk.com/2008/02/12/delimiter-based-key-value-pair-extraction/

1 Solution

somesoni2
SplunkTrust
SplunkTrust

Option 1: use SEDCMD in props.conf on Indexer to format your logs (your can update [hostname] data="foo='bar' dog='cat'" to [hostname] foo="bar" dog="cat" frog="bat")
http://docs.splunk.com/Documentation/Splunk/6.2.2/Data/Anonymizedatausingconfigurationfiles

Option 2: use search time field extraction to cleanup the values. This can be done per field (field extraction) OR for all fields (field transformation)
http://docs.splunk.com/Documentation/Splunk/6.2.2/Knowledge/Createandmaintainsearch-timefieldextract...

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Option 1: use SEDCMD in props.conf on Indexer to format your logs (your can update [hostname] data="foo='bar' dog='cat'" to [hostname] foo="bar" dog="cat" frog="bat")
http://docs.splunk.com/Documentation/Splunk/6.2.2/Data/Anonymizedatausingconfigurationfiles

Option 2: use search time field extraction to cleanup the values. This can be done per field (field extraction) OR for all fields (field transformation)
http://docs.splunk.com/Documentation/Splunk/6.2.2/Knowledge/Createandmaintainsearch-timefieldextract...

ccollord
Explorer

The SEDCMD looks like it'll work just great for what i need. Thanks!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...