Getting Data In

Ingesting data from a syslog server, Splunk is truncating file paths before being written to the source field. How do I disable this?

tmarlette
Motivator

I am ingesting data from a syslog server, and some of those file paths are pretty long. It appears that Splunk is truncating these file paths before it writes the 'source' field. Is there a setting to disable this?

This is what I'm seeing with my search:

index=syslog | stats count by source

Results:

/data/syslog/2016/05/17/...Device/messages  5
/data/syslog/2016/05/17/...dor/messages 8
/data/syslog/2016/05/17/...er/messages  2
/data/syslog/2016/05/17/...ice/messages 5
/data/syslog/2016/05/17/...or/messages  6
/data/syslog/2016/05/17/...orized/messages  7
/data/syslog/2016/05/17/...r/messages   4
/data/syslog/2016/05/17/...rized/messages   3

I'm trying to remove the '...' extensions, and show the whole file path. Would I use a * in the place of the '...' in inputs.conf?

0 Karma
1 Solution

tmarlette
Motivator

This was not an issue at the Splunk level, this was an error within rsyslog that is truncating the log files.

View solution in original post

0 Karma

tmarlette
Motivator

This was not an issue at the Splunk level, this was an error within rsyslog that is truncating the log files.

0 Karma

woodcock
Esteemed Legend

Change your visualization to "Statistics Table" instead of whatever it is now.

0 Karma

jkat54
SplunkTrust
SplunkTrust

Yes, please provide a copy of the relevant inputs.conf, props.conf, and transforms.conf stanzas related to this sourcetype. Splunk does not truncate by default. and '...' in inputs.conf is the same as .* in regex. It should grab everything.

0 Karma

masonmorales
Influencer

What does your inputs.conf look like?

0 Karma

masonmorales
Influencer

Relevant props/transforms too, please.

0 Karma

mtranchita
Communicator

from the way the question is written it isn't clear that this a UI artifact of the search or the actual value of the source field. is it possible to provide more info?

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...