Getting Data In

Ingesting data from a syslog server, Splunk is truncating file paths before being written to the source field. How do I disable this?

tmarlette
Motivator

I am ingesting data from a syslog server, and some of those file paths are pretty long. It appears that Splunk is truncating these file paths before it writes the 'source' field. Is there a setting to disable this?

This is what I'm seeing with my search:

index=syslog | stats count by source

Results:

/data/syslog/2016/05/17/...Device/messages  5
/data/syslog/2016/05/17/...dor/messages 8
/data/syslog/2016/05/17/...er/messages  2
/data/syslog/2016/05/17/...ice/messages 5
/data/syslog/2016/05/17/...or/messages  6
/data/syslog/2016/05/17/...orized/messages  7
/data/syslog/2016/05/17/...r/messages   4
/data/syslog/2016/05/17/...rized/messages   3

I'm trying to remove the '...' extensions, and show the whole file path. Would I use a * in the place of the '...' in inputs.conf?

0 Karma
1 Solution

tmarlette
Motivator

This was not an issue at the Splunk level, this was an error within rsyslog that is truncating the log files.

View solution in original post

0 Karma

tmarlette
Motivator

This was not an issue at the Splunk level, this was an error within rsyslog that is truncating the log files.

0 Karma

woodcock
Esteemed Legend

Change your visualization to "Statistics Table" instead of whatever it is now.

0 Karma

jkat54
SplunkTrust
SplunkTrust

Yes, please provide a copy of the relevant inputs.conf, props.conf, and transforms.conf stanzas related to this sourcetype. Splunk does not truncate by default. and '...' in inputs.conf is the same as .* in regex. It should grab everything.

0 Karma

masonmorales
Influencer

What does your inputs.conf look like?

0 Karma

masonmorales
Influencer

Relevant props/transforms too, please.

0 Karma

mtranchita
Communicator

from the way the question is written it isn't clear that this a UI artifact of the search or the actual value of the source field. is it possible to provide more info?

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...