topic Re: Ingesting data from a syslog server, Splunk is truncating file paths before being written to the source field. How do I disable this? in Getting Data In

Ingesting data from a syslog server, Splunk is truncating file paths before being written to the source field. How do I disable this?

tmarlette — Tue, 17 May 2016 16:19:41 GMT

I am ingesting data from a syslog server, and some of those file paths are pretty long. It appears that Splunk is truncating these file paths before it writes the 'source' field. Is there a setting to disable this?

This is what I'm seeing with my search:

index=syslog | stats count by source

Results:

/data/syslog/2016/05/17/...Device/messages  5
/data/syslog/2016/05/17/...dor/messages 8
/data/syslog/2016/05/17/...er/messages  2
/data/syslog/2016/05/17/...ice/messages 5
/data/syslog/2016/05/17/...or/messages  6
/data/syslog/2016/05/17/...orized/messages  7
/data/syslog/2016/05/17/...r/messages   4
/data/syslog/2016/05/17/...rized/messages   3

I'm trying to remove the '...' extensions, and show the whole file path. Would I use a * in the place of the '...' in inputs.conf?

Re: Ingesting data from a syslog server, Splunk is truncating file paths before being written to the source field. How do I disable this?

masonmorales — Tue, 17 May 2016 20:12:06 GMT

What does your inputs.conf look like?

Re: Ingesting data from a syslog server, Splunk is truncating file paths before being written to the source field. How do I disable this?

masonmorales — Tue, 17 May 2016 20:15:21 GMT

Relevant props/transforms too, please.

Re: Ingesting data from a syslog server, Splunk is truncating file paths before being written to the source field. How do I disable this?

mtranchita — Tue, 17 May 2016 22:19:44 GMT

from the way the question is written it isn't clear that this a UI artifact of the search or the actual value of the source field. is it possible to provide more info?

Re: Ingesting data from a syslog server, Splunk is truncating file paths before being written to the source field. How do I disable this?

jkat54 — Wed, 18 May 2016 16:48:56 GMT

Yes, please provide a copy of the relevant inputs.conf, props.conf, and transforms.conf stanzas related to this sourcetype. Splunk does not truncate by default. and '...' in inputs.conf is the same as .* in regex. It should grab everything.

Re: Ingesting data from a syslog server, Splunk is truncating file paths before being written to the source field. How do I disable this?

woodcock — Sun, 29 May 2016 12:44:59 GMT

Change your visualization to "Statistics Table" instead of whatever it is now.

Re: Ingesting data from a syslog server, Splunk is truncating file paths before being written to the source field. How do I disable this?

tmarlette — Thu, 02 Jun 2016 21:01:08 GMT

This was not an issue at the Splunk level, this was an error within rsyslog that is truncating the log files.