Dashboards & Visualizations

how to extract kv from _raw field which has 50k chars

New Member

In splunk dashboards we want to extract fields from _raw field, we achieved it by  extract pairdelim="{,}" kvdelim=":"  command and displayed the fields using table command. 

Now we see events with more than 50k characters are skipped in the dashboard. Such events are spitted into 3 or more rows in the splunk logs view. 

How to handle such events in the dashboard ? if _raw field can be truncated then which field should be referred for the original message. 

Labels (1)
Tags (2)
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!