I am ingesting data from a syslog server, and some of those file paths are pretty long. It appears that Splunk is truncating these file paths before it writes the 'source' field. Is there a setting to disable this?
This is what I'm seeing with my search:
index=syslog | stats count by source
Results:
/data/syslog/2016/05/17/...Device/messages 5
/data/syslog/2016/05/17/...dor/messages 8
/data/syslog/2016/05/17/...er/messages 2
/data/syslog/2016/05/17/...ice/messages 5
/data/syslog/2016/05/17/...or/messages 6
/data/syslog/2016/05/17/...orized/messages 7
/data/syslog/2016/05/17/...r/messages 4
/data/syslog/2016/05/17/...rized/messages 3
I'm trying to remove the '...' extensions, and show the whole file path. Would I use a *
in the place of the '...' in inputs.conf?
This was not an issue at the Splunk level, this was an error within rsyslog that is truncating the log files.
This was not an issue at the Splunk level, this was an error within rsyslog that is truncating the log files.
Change your visualization to "Statistics Table" instead of whatever it is now.
Yes, please provide a copy of the relevant inputs.conf, props.conf, and transforms.conf stanzas related to this sourcetype. Splunk does not truncate by default. and '...' in inputs.conf is the same as .* in regex. It should grab everything.
What does your inputs.conf look like?
Relevant props/transforms too, please.
from the way the question is written it isn't clear that this a UI artifact of the search or the actual value of the source field. is it possible to provide more info?