Every time I try extracting values for platform, testNames, testId and experience , I always get "\"
Can you please suggest some query to extract these values.
Log format :
time="2018-12-20T22:00:54.868Z", message="bctest batch platform=\"Target\" testNames=\"fitBCTest\",[testName=\"fitBCTest\",testId=\"22323:0:0,\",experience=\"\"]", level="INFO"
Expected Output:
platform= Target
testNames= fitBCTest
testId= 22323:0:0
experience=\
Were you trying to extract these fields using regex?
In your props.conf you should specify KV_MODE = auto_escaped for a sourcetype like this to extract properly