Splunk Search

How to avoid extracting fields from quoted values?

krisreeves
Path Finder

We've noticed that key=value pairs inside a quoted value get extracted too. For example, with an event like foo="bar=baz", the field foo will be extracted with the value bar=baz, but also the field bar will be extracted with the value baz. Is there a way to disable this behavior? (Splunk Enterprise 6.5.4)

This sometimes creates a problem when logging things like URLs that have query strings; if a query string contains a key that has the same name as another field in the event, the extraction of that query string value will override the value of the field we want (possibly later in the line)

0 Karma
1 Solution

thambisetty
SplunkTrust
SplunkTrust

Hi @krisreeves,

Automatic key-value field extraction is a search-time field extraction configuration that uses the KV_MODE attribute to automatically extract fields for events associated with a specific host, source, or source type. Configure automatic key-value field extractions by finding or creating the appropriate stanza in props.conf. You can find props.conf in $SPLUNK_HOME/etc/system/local/ or your own custom app directory in $SPLUNK_HOME/etc/apps/.

so set KV_MODE=none in props.conf to avoid auto kv extractions and write a custom parser for your events either index/search time.

————————————
If this helps, give a like below.

View solution in original post

woodcock
Esteemed Legend

You should set KV_MODE = none to turn off this capability and then create your own unanchored RegEx as a REPORT- search-time extraction to do the same thing, but in a way that you control.

krisreeves
Path Finder

This is pretty unfortunate, but I haven't found a better solution 😕

0 Karma

thambisetty
SplunkTrust
SplunkTrust

Hi @krisreeves,

Automatic key-value field extraction is a search-time field extraction configuration that uses the KV_MODE attribute to automatically extract fields for events associated with a specific host, source, or source type. Configure automatic key-value field extractions by finding or creating the appropriate stanza in props.conf. You can find props.conf in $SPLUNK_HOME/etc/system/local/ or your own custom app directory in $SPLUNK_HOME/etc/apps/.

so set KV_MODE=none in props.conf to avoid auto kv extractions and write a custom parser for your events either index/search time.

————————————
If this helps, give a like below.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...