Getting Data In

Ingesting data from a syslog server, Splunk is truncating file paths before being written to the source field. How do I disable this?

tmarlette
Motivator

I am ingesting data from a syslog server, and some of those file paths are pretty long. It appears that Splunk is truncating these file paths before it writes the 'source' field. Is there a setting to disable this?

This is what I'm seeing with my search:

index=syslog | stats count by source

Results:

/data/syslog/2016/05/17/...Device/messages  5
/data/syslog/2016/05/17/...dor/messages 8
/data/syslog/2016/05/17/...er/messages  2
/data/syslog/2016/05/17/...ice/messages 5
/data/syslog/2016/05/17/...or/messages  6
/data/syslog/2016/05/17/...orized/messages  7
/data/syslog/2016/05/17/...r/messages   4
/data/syslog/2016/05/17/...rized/messages   3

I'm trying to remove the '...' extensions, and show the whole file path. Would I use a * in the place of the '...' in inputs.conf?

0 Karma
1 Solution

tmarlette
Motivator

This was not an issue at the Splunk level, this was an error within rsyslog that is truncating the log files.

View solution in original post

0 Karma

tmarlette
Motivator

This was not an issue at the Splunk level, this was an error within rsyslog that is truncating the log files.

0 Karma

woodcock
Esteemed Legend

Change your visualization to "Statistics Table" instead of whatever it is now.

0 Karma

jkat54
SplunkTrust
SplunkTrust

Yes, please provide a copy of the relevant inputs.conf, props.conf, and transforms.conf stanzas related to this sourcetype. Splunk does not truncate by default. and '...' in inputs.conf is the same as .* in regex. It should grab everything.

0 Karma

masonmorales
Influencer

What does your inputs.conf look like?

0 Karma

masonmorales
Influencer

Relevant props/transforms too, please.

0 Karma

mtranchita
Communicator

from the way the question is written it isn't clear that this a UI artifact of the search or the actual value of the source field. is it possible to provide more info?

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...