topic Custom field from an event is not being parsed correctly in Splunk Search

Custom field from an event is not being parsed correctly

bilalzaib — Mon, 21 Apr 2025 09:57:58 GMT

Hi, We are using the event field message in our alert, but in some cases, the field is not being parsed correctly. For example, in the attached screenshot, the source event contains the full text in raw format, i.e., message="The full message". However, when we check the Event under the Action tab, it only shows the first word of the message — "The" — which results in incorrect information being sent in alerts.

Could someone please help us resolve this issue? I appreciate any help you can provide.

Re: Custom field from an event is not being parsed correctly

ITWhisperer — Mon, 21 Apr 2025 10:19:34 GMT

What sourcetype and extraction configuration are you using?

Re: Custom field from an event is not being parsed correctly

bilalzaib — Mon, 21 Apr 2025 10:55:02 GMT

The logs are coming from a Django application, and the sourcetype is set to the name of the application (as shown by | metasearch sourcetype=* command). This is how we are sending logs from the application

logger.info('Carrier updates summary; message="The following updates message", user="john_doe", carrier_slug="example_carrier"')

We are using below query for extraction

((host="*.prod.domain.com" "Carrier updates summary;") OR (index=prod_index_eks kub.pod_name="domain-*" log="*Carrier updates summary;*")) | eval message=coalesce(message, log) | table message

I hope this provides some context about our logs. Apologies if it doesn’t — I’m still very new to Splunk. I really appreciate your help!

Re: Custom field from an event is not being parsed correctly

ITWhisperer — Mon, 21 Apr 2025 11:25:20 GMT

Assuming you have admin access, you can find the source types under the settings menu option. From this you can find out what extractions are configured, as I suspect these aren't dealing with your custom field as you expect.

You could also try using the extract command

((host="*.prod.domain.com" "Carrier updates summary;") OR (index=prod_index_eks kub.pod_name="domain-*" log="*Carrier updates summary;*")) | extract | eval message=coalesce(message, log) | table message