Splunk Search

Extracting field value gets encoded. Why?

jkim34
New Member

I have extracted value from the message log. So I have custom field with its value.
In the log, it displays "* myName=J&K *"
The extract field is myName, and it's value is now "J\u0026K".
Even when I export this in PDF or CSV, encoded value gets displayed.

Why is this occurring, and is there way to prevent automatic encoding?

0 Karma

p_gurav
Champion

Hi jkim34,

Could you try this regex "myName=(?P[^,\s*(next*)]+)"

0 Karma

jkim34
New Member

Hi p_gurav,
This don't seem to work. Also other field-value do contain white spaces, commas, etc.
This issue so far seems to be an issue with character & < >
At this point, I'm wondering if this is OOTB issue, or something that needs to be done inside configuration file..

0 Karma

ddrillic
Ultra Champion

-- This issue so far seems to be an issue with character & < >
Why does it feel like your data is being treated like XML data? ; - )

0 Karma

jkim34
New Member

You are right. Maybe I should revise my question a bit 🙂

0 Karma

p_gurav
Champion

My bad, Try this:

myName=(?P<myname>[^,\s*(next*)]+)
0 Karma

jkim34
New Member

Sorry, I've actually tried this with bracket <>

0 Karma

p_gurav
Champion

Could you please tell me exact search command you are running and one whole sample event?

0 Karma

jkim34
New Member

Besides regex I stated above, I have following additional information:
Log Message=Form [myAddress=1 Main St., myName=J&K, myPhoneNumber=111-111-1111]
Search Command=search term | table myName

0 Karma

somesoni2
SplunkTrust
SplunkTrust

How are you extracting the field? Can you share configuration/regex for it?

0 Karma

jkim34
New Member

Hi, regex is something like below:

(?<=myName=){1}(?P<myName>.+)(?=, nextKeyWord)

Where it looks for the preceding regex just before the value that I'm extracting for, and until it sees , nextKeyWord

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...