Splunk Search

Issue with automatic field detection

dominiquevocat
Motivator

We have customized our internal applications to a custom key=value schema and it usually works well. Splunk usually recognizes the fields just fine. However in one case it fails.

If the Logline contains
JSocketPlugInImpl: handled :/Workflow/getNextActions

Then the following line
Aug 14 14:34:51 172.26.1.10 14.08.2013 16:41:35 level=INFO stage=prod component=E3 application=evn version=V_06_02_08 service=/Workflow/getNextActions user=xXxXx JSocketPlugInImpl: handled :/Workflow/getNextActions, ReqLen[b]=1000, RspLen[b]=5505 (LogDecorator.java, line 118)

gives me in the field user "xXxXx JSocketPlugInImpl: handled :/Workflow/getNextActions"

Is there something i need to tweak? Or do we have to always put values into " ?

A working logline would be
Aug 15 07:08:26 172.26.1.10 15.08.2013 09:09:51 level=INFO stage=prod component=E3 application=evn version=V_06_02_08 service=/Workflow/setContainer user=xXxXx HPVTraceHandler: Execution of request /Workflow/setContainer [375961] RC=0 took ms: 0 (LogDecorator.java, line 118)

Seems to only affect lines with "JSocketPlugInImpl:"

0 Karma
1 Solution

Ayn
Legend

Splunk will by default recognize field=value pairs and will also by default use "," as a delimiter between field value pairs. So this is simply default behaviour.

View solution in original post

0 Karma

dominiquevocat
Motivator

I have augmented the description.

0 Karma

Ayn
Legend

Splunk will by default recognize field=value pairs and will also by default use "," as a delimiter between field value pairs. So this is simply default behaviour.

0 Karma

dominiquevocat
Motivator

We'll change the app logging to see if it helps but yeah makes sense. Will close the question when we have verified this.

0 Karma

lukejadamec
Super Champion

Can you post an event that does not cause this problem?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...