topic Re: HEC large field value not extracted but is in _raw in Splunk Search

HEC large field value not extracted but is in _raw

simpkins1958 — Tue, 29 Jan 2019 16:30:23 GMT

Have a field in our HEC input that is larger the 10,000 characters. When searching the data input from HEC the field is has not been extracted. It is in _raw and I can pull it out of there. Really would like to be able to have the field extracted.

props.conf has:
TRUNCATE = 0

I can manually input the same data via a text file and the large field (a blob of JSON text) is extracted and available fine. Just not when input via HEC.

See screen shots

Re: HEC large field value not extracted but is in _raw

maciep — Sun, 10 Feb 2019 23:51:53 GMT

i'll ask the dumb question...is the report field in the "3 more fields" link?

Re: HEC large field value not extracted but is in _raw

simpkins1958 — Sun, 10 Feb 2019 23:56:37 GMT

No the report field is not listed.

Re: HEC large field value not extracted but is in _raw

simpkins1958 — Tue, 05 Mar 2019 18:12:09 GMT

When the events are inserted via HEC running a fieldsummary DOES NOT show report field. When the same raw event is input via a file fieldsummary DOES show report field.

Re: HEC large field value not extracted but is in _raw

sdchakraborty — Tue, 05 Mar 2019 18:22:24 GMT

Hi,

Canyou increase the maxchars in limits.conf and try.

https://docs.splunk.com/Documentation/Splunk/7.2.4/Admin/Limitsconf

Sid

Re: HEC large field value not extracted but is in _raw

starcher — Tue, 05 Mar 2019 18:39:05 GMT

If sending into HEC using the event not raw endpoint in JSON.
Set KV_MODE = JSON on the props for that sourcetype. NOT auto...
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf?splunkbot

Re: HEC large field value not extracted but is in _raw

simpkins1958 — Tue, 29 Sep 2020 23:29:53 GMT

Adding this to props.conf fixed the issue:

[nm_MobileDiagnosticsReportData]
KV_MODE = json