topic Re: Field string incorrectly showing post onboarding in Getting Data In

Field string incorrectly showing post onboarding

splunklearner — Tue, 05 Nov 2024 10:55:34 GMT

Hi, F5 team is sending logs to our splunk syslog server as comma seperated values. Post onboarding we see some of field values (string values) are truncating.

Example:

From F5:

Violation_details=xxxxxxxxxxxxx(say 50 words)

after on-boarding to Splunk:

Violation_details=xxxxx (truncating)

What might be the issue here?

Syslog server -- UF -- Indexer (our flow)

Re: Field string incorrectly showing post onboarding

gcusello — Tue, 05 Nov 2024 11:11:10 GMT

Hi @splunklearner ,

I suppose that you're using the standard add-on from Splunkbase (https://splunkbase.splunk.com/app/2846), otherwise, use it.

Check if in the logs are truncated or divided in two events.

If truncated, check the TRUNCATE option for that sourcetype.

If divided, check if in the logs there's some date.

Ciao.

Giuseppe

Re: Field string incorrectly showing post onboarding

PickleRick — Tue, 05 Nov 2024 11:50:36 GMT

The most typical reason for truncation when using syslog is when you're sending events over UDP and you're hitting datagram size limit.

Do you receive syslog on your "syslog server" and write events to file(s) from which you pick them up with an UF? If so, check the contents of the intermediate file(s). If the events are truncated there, it's a problem on the syslog side. If the events are OK there but are truncated after ingesting with UF, it's on UF's (or indexer's) side.

If it's the syslog side, you can try to switch to TCP.