Installation

Splunk 6.5. Issue with Sort and Fields like commands

praveenkpatidar
Explorer

Hello Team,

We have dashboards with queries containing commands like sort - and fields - , what we found after upgrading 6.5.

what we found is the dashboard is automatically updating queries and removing spaces. This in result causing us no data found for the queries. We compared the same dashboard queries in 6.4.2. The automatic trimming happening in 6.5 only.

Any help much appreciated. Seems problem with "-" symbol only
THanks
Praveen

Tags (1)
0 Karma

ziegfried
Influencer

Do you have a a simple example that shows your problem?

0 Karma

hunters_splunk
Splunk Employee
Splunk Employee

Hi Praveenkpatidar,

Not sure your queries in question are related to this, but you can try setting the following in props.conf to turn off the trimming logic:

KV_TRIM_SPACES = false

Please refer to this topic for detailed information:
http://docs.splunk.com/Documentation/Splunk/6.5.0/Admin/Propsconf

Hope it helps. Thanks!
Hunter

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...