topic Re: Splunk not displaying log data in Splunk Search

Splunk not displaying log data

jangid — Thu, 05 Jul 2012 14:32:25 GMT

My log file contain a long line (35000 chars) with continuous spaces [more then 60 spaces] multiple times inside the log - I can't see this log information in Splunk.

I can't change the log because its coming from 3rd party tool

Any Idea?

Re: Splunk not displaying log data

jangid — Thu, 05 Jul 2012 14:33:18 GMT

one option is I can split this line in multiple line based on the number of spaces.

Re: Splunk not displaying log data

Ayn — Thu, 05 Jul 2012 15:33:59 GMT

Do you not see the line at all in Splunk, or do you see a truncated version of it?

Re: Splunk not displaying log data

jangid — Fri, 06 Jul 2012 08:44:10 GMT

I can't see log data at all in Splunk.

I think Splunk ignoring data in a line if detect some continuous spaces - I don't know whether its true or not, its just my guess.

Re: Splunk not displaying log data

Drainy — Fri, 06 Jul 2012 09:09:54 GMT

Have you verified that it has read the file correctly or checked for any errors in the internal logs?

Re: Splunk not displaying log data

jangid — Fri, 06 Jul 2012 10:00:19 GMT

Yes I verified - my log line contains 15 tab char continuously 9-10 times.

due to some privacy reason I can't post entire line here.

Re: Splunk not displaying log data

Drainy — Fri, 06 Jul 2012 10:01:56 GMT

How did you verify that Splunk has read the file correctly?

Re: Splunk not displaying log data

jangid — Fri, 06 Jul 2012 10:50:56 GMT

I can see the data after this line in splunk search

Re: Splunk not displaying log data

jangid — Tue, 10 Jul 2012 12:10:00 GMT

is this bug in Splunk?

Re: Splunk not displaying log data

Drainy — Tue, 10 Jul 2012 12:11:57 GMT

Could you post some example data with the secret parts hashed out or obscured?

Re: Splunk not displaying log data

jangid — Mon, 28 Sep 2020 12:03:36 GMT

I0705 13:59:35.496698 19354 test.cpp:500] test::call: setParam(i=0, 'TEST.XML,,,,,,<<?xml version="1.0" encoding="UTF-8"?>###.APPLICATION162588014750291.03:5 tab1 US0010001 ###.APPLICATION #####.######## , I VALIDATE ID003350000000F3 ########FTI_1341493112469 <####S##een>#########.##############_801475029102</####S##een> fieldName:###########.#### fieldName:#####.####.## fieldName:#####.######## fieldName:#####.###### fieldName:######.####.## <###ordRead>1</###ordRead> ##.###.###.## #########.#### ####.####.#####.### ####.####.##### 1 ####.####.##.#### ####.####.## 1 ############## ############### ############## ############### ############# ########## ############ ########## ############# ################# ############### ########### ###.##### 1 ###.######## 1 ###.###.####### ###########.## ##.#########.#### ##.##.##.#### 1 ##.##.##.### 1 1 ####.###### ####.###.###### 1 ######.### 1 ######.#### ######.COM.DISPLAY ######.### 1 ######.#### 1 ########.######## ######.####.## ####.#### ######.##### ######.###### ###.######.### ###.###.###.### ##.#### COLL.###.## ##########.### 1 ##########.#### ##########.### 1 ##########.#### 1 #####.###### ##.######.###D.Y.N ######.####.## IBMUSD ######.###### ######.####.#### ######.######## ######.######## ######.#####.### ######.#####.#### ####.## ########.###.## 1 ########.###.DR 1 ####.GROUP.LEVEL ########.#### ########.SPREAD DATE.TIME 1 DEAL.MARKET DEALER.DESK #####.####.## DELLUSD #####.###### 1000 #####.####.#### #####.######## USD #####.######## #####.#####.### #####.#####.#### ########.##### ########.### ########.###### 1 ####.#### DR.######.###D.Y.N DRAWN.###OUNT EXPECTED.#####.## EXPECTED.###S.## EXPOSURE.#### EXTEND.###MAT EXTEND.#### FED.##### FREE.TEXT.###TO 1 ##.###.#####.### ##.###.#####.## 1 ##.####.#####.### ##.###.####.## ##.###.##### 1 ##.###.######## 1 ##.###.###.####### ##.##.##.## 1 ##.#.###.###.## 1 ##.#.##.#.##.## 1 ##.#.##TMED.## 1 ##.#.###.## 1 ##.#####.####.## ##.#####.VDATE ##.EXCH.#### ##.##STR.#### 1 ##.##TERMED.### ##.##TERMED.## 1 ##.##TMED.##### 1 ##.###.####.#### ##.ORDERING.## 1 ##.ORDERING.CUS 1 ##.###.######S 1 ##.PROCESS.ERR 1 ##.REASON.OVE 1 ##.###.### ##.###.####.### ##.###.####.## 1 ##.####.### 1 ##.####.####.## 1 ##.#####.### 1 ##.TIME.### 1 INP.###.### ######## 1 INSTRCTN.#### 1 ##########.### #######.#####.### #######.##### 1 ###.####.### ######.###.#### ######.######.#### ###.###.######## ###.###.######## ###.####.### ###.###.###S.### ###.##T.###.### #####.#.######.### #####.#.##### MAILING MESSAGE.#### 1 MESSAGE 1 ####.####.###### ###.#### 1 ###.#### 1 #####.#### ###.######.###NO #######.###### ##.##.#####.##### ###.####.#### ###.####.#### ORDERING.##### 1 ORDERING.#### 1 OVERRIDE 1 ######.###.## ###.###### #####.#### #######.######S 1 ########.#### ##########.### ##########.#### ######.######.#### ######.######.#### ####.###### ####.######.### ####.#####.### ###.####.#####.### ###.####.##### 1 ######.###.#### ########.##### ######.###### ########.### 1 ########.### ########.1 ########.10 ########.11 ########.12 ########.13 ########.14 ########.15 ########.16 ########.17 ########.18 ########.2 ########.3 ########.4 ########.5 ########.6 ########.7 ########.8 ########.9 ######.###### ######.##.#### ########.### #####.#### #######.### ####.#######.Y.N ####.##.##### 1 ######.## ######### 1 ###### ####.### 1 #####.###### #####.######## ###.### 1 ###.#### 1 #####.####.#### ###.######### ####.### 1 1 ###.###.### ###.###.###.##### ###.###.###.### ###.###.#### ###.###.####.### ###.###.###.##### #####.######.### #####.###.###### ###########.#### AC ########.#### ###.###.### ')

Re: Splunk not displaying log data

jangid — Wed, 11 Jul 2012 10:36:27 GMT

I am not sure whether this editor will truncate some TAB char or not, if you give me your email address I'll send you text format.

Re: Splunk not displaying log data

jangid — Mon, 16 Jul 2012 14:39:31 GMT

Does anyone get a chance to figure out?

Re: Splunk not displaying log data

jangid — Thu, 19 Jul 2012 12:25:23 GMT

I think this is bug in Splunk - this same behavior for similar log with multiple tab or spaces.

can you guys please confirm?

Re: Splunk not displaying log data

jangid — Fri, 20 Jul 2012 08:28:53 GMT

Hi Drainy any update regarding my query?

Re: Splunk not displaying log data

Drainy — Fri, 20 Jul 2012 08:38:30 GMT

Sorry, I've been out and abooot. Well Splunk shouldn't have any issue with that really, if anything it could be a line-breaking issue with how Splunk is splitting the data. Perhaps you could paste it to pastebin.com, then we can grab a decent copy to test on our own systems

Re: Splunk not displaying log data

jangid — Fri, 20 Jul 2012 10:01:03 GMT

Thanks for your quick response.
in splunk is there any option to remove tab char or spaces between > < char before forwarding?

Re: Splunk not displaying log data

Drainy — Fri, 20 Jul 2012 10:20:46 GMT

You can remove them before indexing, but its unlikely that Splunk is struggling with them. It could be the Web UI struggling to render them perhaps but I am dubious that it isn't dealing with the tab or spaces as at a very basic level they are just another character.

Re: Splunk not displaying log data

jangid — Mon, 23 Jul 2012 16:48:18 GMT

Hi Drainy, can you please tell me how to remove TAB and space char before indexing?

Re: Splunk not displaying log data

jangid — Mon, 13 Aug 2012 09:33:36 GMT

After removing tab spaces I am still loosing my data in splunk 😞