topic Re: Blank Character in string in Splunk Search

Blank Character in string

rafamss — Wed, 18 Feb 2015 16:03:46 GMT

Hi,

I have a index configured to get data from a database MSSQL. Well, The data are be obtained with sucess but one column have a string with various blank spaces inside her. When I do my query in Splunk, I don't see the complete string.

Example of content of the String Field: Error in the database. Contact the admin.

I see in Splunk the content of column, in Search , but I don't can find the content by query like a parameter by example.

Example:

index="my index" StringField="Error in the database. Contact the admin."

The result of this query don't return anything. But there are data with this parameter in index.

What I can do ?

Thanks an advance,

Re: Blank Character in string

HiroshiSatoh — Thu, 19 Feb 2015 08:04:06 GMT

I can search so, cause you can not find it I think is in the other.

Re: Blank Character in string

rafamss — Thu, 19 Feb 2015 10:32:40 GMT

Hi Hiroshi,

Interesting! But in my Search query, it isn't works. See the images below.

In the first image, the search query return my search; In the second image, the left side panel don't shows my search query and in the third image, the search query, I aggregates the search query using the stats command, but in the panel Statistics, doens't show this.

What do you think ?

Image 1

Image 2

Re: Blank Character in string

rafamss — Thu, 19 Feb 2015 10:34:29 GMT

I can't insert the third image, sorry.

Re: Blank Character in string

HiroshiSatoh — Thu, 19 Feb 2015 12:05:32 GMT

I think that it has failed to field extraction. I think that it needs re-definition of the field.

Re: Blank Character in string

rafamss — Thu, 19 Feb 2015 12:51:01 GMT

I think too. I'll verify this and return. Tks!