Archive
Highlighted

Limit message length

Explorer

Hello,

How can i limit the nuber of character displayed in the message field?

Thank you.

Tags (2)
0 Karma
Highlighted

Re: Limit message length

Champion

What message field? Are you talking about limiting the value of a field?

0 Karma
Highlighted

Re: Limit message length

Explorer

Yes limit value of a field. For exemple the message field is very long for some Messages, is it possible to limit the display?

Thank you.

0 Karma
Highlighted

Re: Limit message length

New Member

I'm very new to Splunk so forgive me if this isn't the best method available. I too was having this issue with limiting the length/size of Messages from Windows 2008 Security Logs. The work answer for me was to use the regex creation tool.

  • Take a sample event and use the field extractor function. (Little drop down arrow in the top left corner.)
  • This will open a new tab for Extract fields.
  • In the sample events highlight the message that you are wanting to see and past this into the "Example values for a field:"
  • Generate the regex then rename it as something more user friendly.

Again this may be a beginner stuff but it worked for me!

0 Karma
Highlighted

Re: Limit message length

Explorer

eval Message=split(Message,".") | eval ShortMessage=mvindex(Message,0) Gives the first sentence of the Windows Message field. Split divides the Message field by sentences (split at each period "." - the second command populates the first sentence (0) into the field called "ShortMessage"

0 Karma