is there a way that autoKV can support both spaces and quote chars in field values?

Question

I'm writing an app that's based on a scripted input, and I'm trying to just dump out my key value pairs so the field extraction will be handled by autoKV.

someField=bar  someOtherField=12.4

Some of my field values can have space characters in them, but that's OK -- if you dig around in the docs the answer for that is to wrap the values in quotes and then autoKV will be tolerant of space characters:

someField="foo bar" someOtherField="12.4"

However if the field values also contain quote characters, I dont think there's any way to get autoKV to index the value correctly.

eg: someField="foo \" bar"

results a field value of "foo \".

I had hoped that autoKV would be smart enough to extract it as foo " bar, or failing that, as 'foo \" bar'

Any ideas, or do I have to switch to a csv approach?

Answer 1

1

Nick,

I had success w/ turning off KV and using DELIMS.

## props.conf
[<your_sourcetype>]
KV_MODE = none
REPORT-kv_for_your_sourcetype = kv_for_your_sourcetype

## transforms.conf
[kv_for_wookie]
DELIMS = " ", "="

link

answered 19 Apr '11, 17:56

hazekamp
2.0k●11
accept rate: 38%

Thanks hazedav! I'll be back on this tomorrow and I'll give it a shot then.

(20 Apr '11, 22:45) nick ♦

Nick, were you able to work around this using delims, or other? Having the same issue w/ a scripted input.

(29 Apr '11, 10:58) jeffa

I actually havent been able to get back to working on this particular app. Others have been bumped up in priority. I'll probably be back on this next week though and I'll update then at least.

(29 Apr '11, 11:00) nick ♦

Answer 2

0	This is a known issue and we're working on adding support for escape characters within quoted values in for autokv. Should land in our next major release (5.0) link answered yesterday Ledion Bitincka ♦ 1.5k●3●6 accept rate: 34%

is there a way that autoKV can support both spaces and quote chars in field values?

Follow this question

Splunk Resources

Related questions