topic Re: Limit message length in Splunk Search

Limit message length

smarechal — Wed, 25 Jan 2012 10:42:47 GMT

Hello,

How can i limit the nuber of character displayed in the message field?

Thank you.

Re: Limit message length

Drainy — Wed, 25 Jan 2012 10:48:44 GMT

What message field? Are you talking about limiting the value of a field?

Re: Limit message length

smarechal — Wed, 25 Jan 2012 12:00:44 GMT

Yes limit value of a field. For exemple the message field is very long for some Messages, is it possible to limit the display?

Thank you.

Re: Limit message length

MelCharley — Wed, 30 May 2012 00:08:56 GMT

I'm very new to Splunk so forgive me if this isn't the best method available. I too was having this issue with limiting the length/size of Messages from Windows 2008 Security Logs. The work answer for me was to use the regex creation tool.

Take a sample event and use the field extractor function. (Little drop down arrow in the top left corner.)
This will open a new tab for Extract fields.
In the sample events highlight the message that you are wanting to see and past this into the "Example values for a field:"
Generate the regex then rename it as something more user friendly.

Again this may be a beginner stuff but it worked for me!

Re: Limit message length

tinylund — Tue, 29 Sep 2020 18:46:00 GMT

eval Message=split(Message,".") | eval Short_Message=mvindex(Message,0) Gives the first sentence of the Windows Message field. Split divides the Message field by sentences (split at each period "." - the second command populates the first sentence (0) into the field called "Short_Message"