Getting Data In

Powershell Scripted input truncated in raw

spluzer
Communicator

Hey Splunksters,

I have a scripted input (powershell) that outputs correctly 6 fields on the screen like this:

expiration_date          user       login                            cardRequired          location     account_last_changed
mm/dd/yy 15:03        joblo      some_stats              true/false                  blah             mm/dd/yy 16:06


However, when splunk ingests these fields, it is cutting off the last one (account_last_changed) in the _raw

Anybody know why? 

Tried setting TRUNCATE=0 and TRUNCATE=500000   etc etc in the props.conf

Cannot for the life of me get that last field to show up in Splunk

I also thought that perhaps it was treating that last field like a new time_stamp ans was thus getting confused and cutting it off.  However, I tried moving the field closer to the first time_timestamp in the actual script (got all six fields to output correctly to the screen) but Splunk was still cutting it off.

Any help is much appreciated!

Thanks!





Labels (1)
0 Karma

yannK
Splunk Employee
Splunk Employee

depending on how your sourcetype is defined, the events may be kept in a block, broken per line, broken on new timestamps etc... Also if you are using. "INDEXED_EXTRACTIONS" on the forwarder, the events ma be parsed on the forwarder, not on the indexers (you need to customize the props.conf on the forwarder then)

if you want to create a working sourcetype props.conf, I would recommend to pick your sample of data, and try to ingest it on a SH, in the UI, using the editor to improve the parsing. At the end, copy past the props.conf, and deploy it on the indexers (or forwarder if you use special parsing on the forwarder)

https://docs.splunk.com/Documentation/Splunk/latest/Data/Setsourcetype

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...