Splunk Search

kv extract escape keyword

EricPartington
Communicator

using the opsec lea app and noticed that two of the default kv extract key/value pairs werent working for me. The log entry for the relevant key/value was i/f_dir and i/f_name not i_f_dir and i_f_name. I tried to escape the / in the key but that failed as the extracted format was f_name and f_dir.

How do you escape the / in the key?

i///f_dir
i\/fdir
i//f_dir

Here is the attempted setting in props.conf I know its failing as the key displayed in the seach window is not direction and inbound_interface instead its f_name and f_dir.

[if_dir]
#had to modify from i_f_dir
SOURCE_KEY=i//f_dir
REGEX=(.*)
FORMAT=direction::$1

[if_name]
#had to modify from i_f_name
SOURCE_KEY=i//f_name
REGEX=(.*)
FORMAT=inbound_interface::$1
1 Solution

Ledion_Bitincka
Splunk Employee
Splunk Employee

Can you provide an example of a log line? By default during kv extraction splunk replaces non alphanumeric characters in keys with '_' to make working with fields easier.

View solution in original post

0 Karma

EricPartington
Communicator

the new version of the checkpoint binary solves this problem for me. the names of the fields are now named and extracted properly.

thanks for the follow up

Eric

0 Karma

Ledion_Bitincka
Splunk Employee
Splunk Employee

Can you provide an example of a log line? By default during kv extraction splunk replaces non alphanumeric characters in keys with '_' to make working with fields easier.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...