https://community.splunk.com/t5/Splunk-Search/How-to-prevent-a-space-character-from-delimiting-and-truncating/m-p/184967#M53275 <P>Hi folks,</P> <P>I have some new logs coming in, and I took a look at the fieldname that has a Windows filename in it, and it is being truncated after the space character (if there happens to be one).</P> <P>The events are coming in via DB Connect, multiline, and I can see the whole filename in the _raw event:</P> <PRE><CODE>event_guid=ABDC1234-EE33-43F3-ABCDEF file_size=3432342 source_file=//home.local/home/caddev/usernameish/temp deck overview.pptx target_path= </CODE></PRE> <P>So the event is indexing fine, but when I search, and Splunk does it's generic field extraction, the source_file field turns into:</P> <PRE><CODE>source_file=//home.local/home/caddev/usernameish/temp </CODE></PRE> <P>Is there a quick way to fix this?</P> Mon, 24 Aug 2015 20:43:07 GMT jravida 2015-08-24T20:43:07Z https://community.splunk.com/t5/Splunk-Search/How-to-prevent-a-space-character-from-delimiting-and-truncating/m-p/184967#M53275 <P>Hi folks,</P> <P>I have some new logs coming in, and I took a look at the fieldname that has a Windows filename in it, and it is being truncated after the space character (if there happens to be one).</P> <P>The events are coming in via DB Connect, multiline, and I can see the whole filename in the _raw event:</P> <PRE><CODE>event_guid=ABDC1234-EE33-43F3-ABCDEF file_size=3432342 source_file=//home.local/home/caddev/usernameish/temp deck overview.pptx target_path= </CODE></PRE> <P>So the event is indexing fine, but when I search, and Splunk does it's generic field extraction, the source_file field turns into:</P> <PRE><CODE>source_file=//home.local/home/caddev/usernameish/temp </CODE></PRE> <P>Is there a quick way to fix this?</P> Mon, 24 Aug 2015 20:43:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-prevent-a-space-character-from-delimiting-and-truncating/m-p/184967#M53275 jravida 2015-08-24T20:43:07Z https://community.splunk.com/t5/Splunk-Search/How-to-prevent-a-space-character-from-delimiting-and-truncating/m-p/184968#M53276 <P>you need to build the extraction for that. A quick way is to use the extract fields in the event actions.<BR /> Check these splunk docs:<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.2.5/Knowledge/ExtractfieldsinteractivelywithIFX">http://docs.splunk.com/Documentation/Splunk/6.2.5/Knowledge/ExtractfieldsinteractivelywithIFX</A></P> Mon, 24 Aug 2015 20:56:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-prevent-a-space-character-from-delimiting-and-truncating/m-p/184968#M53276 diogofgm 2015-08-24T20:56:01Z https://community.splunk.com/t5/Splunk-Search/How-to-prevent-a-space-character-from-delimiting-and-truncating/m-p/184969#M53277 <P>The extract fields utility is broken in my install. I'll have to investigate further, but for now it is erroring out.</P> Tue, 25 Aug 2015 16:37:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-prevent-a-space-character-from-delimiting-and-truncating/m-p/184969#M53277 jravida 2015-08-25T16:37:59Z https://community.splunk.com/t5/Splunk-Search/How-to-prevent-a-space-character-from-delimiting-and-truncating/m-p/184970#M53278 <P>The raw file is multiline events OR everything is coming in single line? Does the file name always contain extension of the file??</P> Tue, 25 Aug 2015 18:57:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-prevent-a-space-character-from-delimiting-and-truncating/m-p/184970#M53278 somesoni2 2015-08-25T18:57:20Z