topic Re: Problem to indexer a multivalue field too longer in Splunk Search

Problem to indexer a multivalue field too longer

adolfus1982 — Tue, 26 Nov 2019 10:37:05 GMT

Hi everybody
Trying to index a multivalue field with more than 6000 characters approx. With the same sourcetype we have two behaviour: If the length of that field is minor than 6000 it's indexed correctly, nevertheless if that field is greater than 6000 is being saved just the first element removing the rest of that field and stopping indexing the rest of the fields.

For example if event contains the follow info :
field1:"1231644", field2:"64614",field3:"sdfeee", field4:"ghdddfgd", field5:"1616",field6:"1231644",
field7:"xxxxxx1, xxxxxxx,xxxxxx2, xxxxxx3, xxxxxx4,xxxxxxx, xxxxxxx, xxxxxxx,xxxxxxx, xxxxxxx, xxxxxxx,xxxxxxx, xxxxxxx......xxxx12158",field8:"464641", field9:"7416",

When I extract info, it shows :
field1:1231644
field2:64614
field3:sdfeee
field4:ghdddfgd
field5:1616
field6:1231644
field7:"xxxxxx1
date:
index

So field8 ,field9 and following aren´t

Re: Problem to indexer a multivalue field too longer

techiesid — Tue, 26 Nov 2019 14:12:05 GMT

Hello,

Can you check the the props.conf config file for that sourcetype and see whether there is any settings for TRUNCATE.

TRUNCATE = <non-negative integer>
* The default maximum line length, in bytes.
* Although this is in bytes, line length is rounded down when this would
  otherwise land mid-character for multi-byte characters.
* Set to 0 if you never want truncation (very long lines are, however, often
  a sign of garbage data).
* Default: 10000

https://docs.splunk.com/Documentation/Splunk/8.0.0/Admin/Propsconf

Sid

Re: Problem to indexer a multivalue field too longer

adolfus1982 — Wed, 30 Sep 2020 03:04:57 GMT

In props.conf has no TRUNCATE, and the default value of 10000 is greater than the length of my data:

Content of this file is:

```
[source::.../.txt]
EXTRACT-codproceso=\/(?[\d]+)\s in source
EXTRACT-proceso=\s(?[a-zA-ZñÑáéíóúÁÉÍÓÚçÇ\s]+)[\d-_].txt in source
EXTRACT-fichero=.*\/(?[^\n]+) in source
EXTRACT-codusr=(?[^\@]+) in EMAIL_USU

[mxp_agentes]
EXTRACT-fecactu = (?\d{8}) in NUM_REF_AGN

[mxp_transfer]
EVAL-_time = strptime(timestamp_path,"%Y/%m/%d")

[host::IDX_lugar]
TRANSFORMS-routing=routing_mexico
```