topic Re: Addition of '=' between events in Getting Data In

Addition of '=' between events

lohit — Fri, 29 May 2015 06:07:07 GMT

Hi all ,

I have a indexes which is capturing logs in real time. However i have observed a strange thing happening when events are indexed in splunk. Splunk is adding a '=' between the event text. Below is an small snippet from logs

Raw logs:
2D 0A 41 63 Firefox/38.0..Ac
000 cept:

Splunk Indexed logs:
User-Agent: Mozilla/5.0 () Gecko/21 Fir=
efox/38.0

I am not what is happening. are my events being truncated ?

Any help !!

Re: Addition of '=' between events

woodcock — Fri, 29 May 2015 06:19:38 GMT

This is not Splunk; I am sure it is happening in your raw files before Splunk touches them. This is a sign of Quoted-printable encoding; QP works by using the equals sign "=" immediately followed by carriage return as an escape character to indicated a forced line-break, usually to limit the line length to 76, as some software/protocols (e.g. SMTP) have limits on line length.

Re: Addition of '=' between events

lohit — Fri, 29 May 2015 06:32:48 GMT

Thank you Woodcock.