topic Re: stats & table truncating the field value in Knowledge Management

stats & table truncating the field value

RSS_STT — Tue, 29 Apr 2025 17:58:30 GMT

Raw message showing the correct filed value but stats & table truncating the field value.

RAW meassge:

Message=" | RO76 | PXS (XITI) - Server - Windows Server Down Critical | Server "RO76 is currently down / unreachable."

Table & Stats showing:

Message=| RO76 | PXS (DTI) - Server - Windows Server Down Critical | Server

it breaking after " sign.

Re: stats & table truncating the field value

PickleRick — Tue, 29 Apr 2025 18:30:03 GMT

Your question is a bit skimpy on details but I assume that your event contains a string

Message=" | RO76 | PXS (XITI) - Server - Windows Server Down Critical | Server "RO76 is currently down / unreachable."

somewhere within its contents.

And I suspect you're using the value of a field Message which is (probably automatically) extracted from your event. And this field is "truncated".

Most probably it's due to either (depending on how you look at it) badly/not defined extractions or badly formatted data. Splunk apparently uses key="value" format to find field(s) in your raw data. Since your value contains a quote, this quote delimits the value of the field. Depending on your data you might be able to define extraction catching the whole string if you can anchor the regex somewhere after that string. But as a general rule you should not have data containing unescaped delimiter.

Re: stats & table truncating the field value

livehybrid — Tue, 29 Apr 2025 21:11:15 GMT

Hi @RSS_STT
It is breaking because it is treating the double quotes as the end of the string. Is Message=* the last part of your event, or is there more text after the message?

If its always the last part of the event then you could use the following rex command to create a new "fullMessage" field:

| rex field=_raw "Message\=\"(?<fullMessage>.+)\"$"

See screenshot of an example:

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing