Why is Splunk 6.5.1 not able to search when event has data with delimiter ~ while field extraction is working as expected?

[NeerajDhapola7]

Why is Splunk 6.5.1 not able to search when event has data with delimiter ~, while field extraction is working as expected. Issue with search with extracted field=value

another question while extracting fields i was using !#! as separator but its not working.
Can't we use multiple characters as separator !#! ?

Thanks
Neeraj Singh Dhapola

[Masa]

1. DELIMS = "~" should work for events like "Value01~Value02~Value03"
2. DELIMS = "!#!" will translated as "! OR # OR !" because DELIMS takes one character as a separator.

If this does not help, please provide examples of events, configuration of props and transforms.

[NeerajDhapola7]

@Masa Thanks for the response

1. DELIMS = "~" should work for events like "Value01~Value02~Value03"

Event data example :
2017/03/13 17:04:03.901000~13-MAR-17 05.04.03.885000 PM~13-MAR-17 05.04.03.886000 PM~xxx Client~xxxx~~com.ConnectionError: Error while connecting to remote host.~~~xxxxxxxx~xxxxxxxxxx~xxxxxx/~PASS~xxxxxx~BIS~~xxxx-xxxx-xxx-xx-xxxx~xxxx-0849-11e7-xxx-xxxxx~0~0
When you do mouse over to extract the field for the search splunk is not able to separate with ~ sign OR
once you did field extract after the if you do query on field (i.e field1=xxxx) not able to get result.

I hope this will make more clear. (as of now I have changed ~ to | )

1. DELIMS = "!#!" will translated as "! OR # OR !" because DELIMS takes one character as a separator. Yes, this one resolved the issue as I can use only one character as separator. Issue is when I am selection OTHER and its showing text box where I can give more then 1 character which is giving sense that I can use more then 1 characters as separator. Need to update TEXT box length as 1

[niketn]

@NeerajDhapola7... Please add mocked up test data, field extraction you have created, search with issue and what is the issue.
Please provide more context for your second issue as well. Add example with special characters as separators and also what was the field extraction which did not work?

Following is a run anywhere example which works fine for me. Kindly provide more details and mock data so that we can assist.

| makeresults
| eval teststr="my test string !#! with ~ tilde and separator !#! with issues"
| rex field=teststr "(?<data1>.*)\!\#\!(?<data2>.*)\!\#\!(?<data3>.*)"
| eval newstr=if(match(data2,"~"),"Found Tilde","Tilde Not found")

[jaredlaney]

This is an old question but I'm seeing the same strange behavior with tilde as a delimiter. I'm going to see if I can recreate with data.

[payl_chdhry]

found any solution for this? We too as facing issue with tilde as delimiter.