Splunk Search

Why is my name value pair being truncated after comma?

Splunkster45
Communicator

Here is what my log looks like:

    Date_filed=record_create_ts
    Grain=D
    Load_Frq=D
    Data=18,2014-05-20
    Number=3,2,169
    Date=2014-05-21,2014-05-22,2014-05-24 

When I run the following command on the log ...| table Number Date

I get the following:
alt text

I thought that I would get '3,2,169' instead of just '3'. Does any one know why this is happening?

Tags (2)
0 Karma

DalJeanis
SplunkTrust
SplunkTrust

try this command before the table command

| makemv "," Data Number Date

somesoni2
SplunkTrust
SplunkTrust

Comma act as pair delimiter if the values are enclosed with double quote. You would need to setup custom field extractions for that type values or update your logging to enclose the values within double quotes.

0 Karma

Splunkster45
Communicator

Thanks, this is super helpful!

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...