topic Re: Event log cannot be fully displayed in Field Extractor in Splunk Search

Event log cannot be fully displayed in Field Extractor

LuiesCui — Sun, 10 Mar 2019 07:53:13 GMT

Hey fellow Splunker's. I'm trying to extract some fields from Windows event logs. When I search these logs the content looks great:

But when I want to extract more fields, some of the content just disappear in Field Extractor:

So I can't get those fields extracted. Any suggestions? Thanks in advanced!

Re: Event log cannot be fully displayed in Field Extractor

skalliger — Sun, 10 Mar 2019 16:17:20 GMT

Did you try setting CHARSET = UTF-16 in your props.conf?

Skalli

Re: Event log cannot be fully displayed in Field Extractor

LuiesCui — Mon, 11 Mar 2019 02:26:28 GMT

Hi Skalli, thanks for you reply. I put CHARSET = UTF-16 to the props.conf in my app and still don't see the rest of the content.

Re: Event log cannot be fully displayed in Field Extractor

lakshman239 — Mon, 11 Mar 2019 10:53:15 GMT

I believe the splunk's extractor only loads certain number of chars/events.. Have you loaded your event to rex101 [ https://regex101.com/] and tried to extract your required fields?

Another option, would be to setup the universal forwarder to collect the data in XML renderXml=true [ if that's acceptable in your case, as it will show everything in english]

Re: Event log cannot be fully displayed in Field Extractor

damann — Tue, 12 Mar 2019 11:27:38 GMT

The built in field extractor could work but why don't you build your regex from scratch?
www.regex101.com will help and explain you a lot!

If you provide an example event and describe what you want to have extracted I'm sure that i can help you with that.