Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How do I escape values in Splunk?

Tags:

splunk

Splunk best practices say to use key/value pairs. It also says to wrap values in quotes if they contain spaces. So, let's say I have a raw value of Fred Smith:

my_key=name my_value="Fred Smith"

That's fine, I've added the quotes. But what if I have a raw value of " Fred Smith" (note the quotes already present and the presence of a space at the start) - this would yield:

my_key=name my_value="" Fred Smith""

This would be treated as:

my_key=name my_value=""
my_key=Fred my_value=Smith""

What are the best practices for escaping quotes in Splunk values?

like image 984
Steve Dunn Avatar asked Jul 30 '15 09:07

Steve Dunn


1 Answers

If you control the data format, which it appears you do, your options include:

  • Add single quotes around everything.
  • Use double-quotes, but escape the inner ones with backslashes
  • Use JSON to represent the data instead of a flat string of KV pairs. JSON syntax handles this quoting case (without adding extra quote marks), plus you can add nested structure if you want.

You can control the search-time field extraction behavior by setting KV_MODE. You may find that auto_escaped will do the trick. See Setting KV_MODE for search-time data in the Splunk Knowledge Manager manual.

like image 133
halr9000 Avatar answered Oct 23 '22 08:10

halr9000