Dev Tutorial question about "DESCRIPTION: AInterpidPanoramaofaMadScientistAndaBoywhomustRedeemBoyinAMonastery"

jcorcoran508 — Tue, 22 Feb 2022 15:48:40 GMT

I have a question on the Dev tutorial as I am unable to figure the behavior or is the output expected under the

DESCRIPTION: AInterpidPanoramaofaMadScientistAndaBoywhomustRedeemBoyinAMonastery

All the words in “DESCRIPTION” are not delimited a by a white space , is the normal behavior ?

Module 1 of the Splunk>Dev tutorial

https://dev.splunk.com/enterprise/tutorials/module_getstarted/

Set up the sample data bundle

To get the Eventgen sample bundle and send it to the devtutorial index, do the following steps:

Go to https://github.com/splunk/eventgen/blob/develop/tests/sample_bundle.zip and click Download to download the Eventgen sample data file, sample_bundle.zip, to your computer.

DESCRIPTION

AInterpidPanoramaofaMadScientistAndaBoywhomustRedeemBoyinAMonastery

Re: DESCRIPTION: AInterpidPanoramaofaMadScientistAndaBoywhomustRedeemBoyinAMonastery

tshah-splunk — Tue, 22 Feb 2022 04:54:24 GMT

Hey @jcorcoran508,

You can proceed ahead with further modules. The data seems to be perfect and not sure what is the need for delimiting a white space character in the description field. Also, I can see in the screenshot that the description field is properly extracted by the json sourcetype.

topic Re: DESCRIPTION: AInterpidPanoramaofaMadScientistAndaBoywhomustRedeemBoyinAMonastery in Splunk Dev

Dev Tutorial question about "DESCRIPTION: AInterpidPanoramaofaMadScientistAndaBoywhomustRedeemBoyinAMonastery"

Re: DESCRIPTION: AInterpidPanoramaofaMadScientistAndaBoywhomustRedeemBoyinAMonastery