I am ingesting data from a syslog server, and some of those file paths are pretty long. It appears that Splunk is truncating these file paths before it writes the 'source' field. Is there a setting to disable this?
This is what I'm seeing with my search:
index=syslog | stats count by source
/data/syslog/2016/05/17/...Device/messages 5 /data/syslog/2016/05/17/...dor/messages 8 /data/syslog/2016/05/17/...er/messages 2 /data/syslog/2016/05/17/...ice/messages 5 /data/syslog/2016/05/17/...or/messages 6 /data/syslog/2016/05/17/...orized/messages 7 /data/syslog/2016/05/17/...r/messages 4 /data/syslog/2016/05/17/...rized/messages 3
I'm trying to remove the '...' extensions, and show the whole file path. Would I use a
* in the place of the '...' in inputs.conf?
Yes, please provide a copy of the relevant inputs.conf, props.conf, and transforms.conf stanzas related to this sourcetype. Splunk does not truncate by default. and '...' in inputs.conf is the same as .* in regex. It should grab everything.
from the way the question is written it isn't clear that this a UI artifact of the search or the actual value of the source field. is it possible to provide more info?