Why are Interesting Fields not yielding complete values in the search result?

muguniya — Fri, 26 Jun 2015 15:46:14 GMT

Hi,

When a blank space is introduced in values, the search results are not yielding complete values. Please see details below.

Event in Splunk looks like:

id=43777924d6-fda8-4c2b-9884-2f85c6f84b4e
queryType=join
accountName=Test Acc
anchor=
applicationName=Test Application
siteName=PUSH to Test Site

My current search and result using the table command:

index=db-general source="dbmon-tail://Logging*" | table accountName,applicationName,siteName

Actual Search Result in Table format does not have complete values for accountName, applicationName, siteName:

accountName    applicationName    siteName↕ 
Test           Test               PUSH

Expected result should be as shown below:

accountName    applicationName    siteName
Test Acc       Test Application   PUSH to Test Site

Any help in this regard is much appreciated.

Thanks.

Re: Why are Interesting Fields not yielding complete values in the search result?

vinitatsky — Fri, 26 Jun 2015 16:03:27 GMT

Also you can check if 'accountNameWithSpace' is giving correct value (with spaces)

field=_raw "accountName=(?P[\S\s]+)"