stats & table truncating the field value

[RSS_STT]

Raw message showing the correct filed value but stats & table truncating the field value.

RAW meassge:

Message=" | RO76 | PXS (XITI) - Server - Windows Server Down Critical | Server "RO76 is currently down / unreachable."

Table & Stats showing:

Message=| RO76 | PXS (DTI) - Server - Windows Server Down Critical | Server

it breaking after " sign.

[livehybrid · Accepted solution]

Hi @RSS_STT 
It is breaking because it is treating the double quotes as the end of the string. Is Message=* the last part of your event, or is there more text after the message?

If its always the last part of the event then you could use the following rex command to create a new "fullMessage" field:

| rex field=_raw "Message\=\"(?<fullMessage>.+)\"$" 

See screenshot of an example:

| windbag | head 1 
| eval _raw="User=testing Message=\" | RO76 | PXS (XITI) - Server - Windows Server Down Critical | Server \"RO76 is currently down / unreachable.\""
| rex field=_raw "Message\=\"(?<fullMessage>.+)\"$" 
| table _time fullMessage

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[PickleRick]

Your question is a bit skimpy on details but I assume that your event contains a string

Message=" | RO76 | PXS (XITI) - Server - Windows Server Down Critical | Server "RO76 is currently down / unreachable."

somewhere within its contents.

And I suspect you're using the value of a field Message which is (probably automatically) extracted from your event. And this field is "truncated".

Most probably it's due to either (depending on how you look at it) badly/not defined extractions or badly formatted data. Splunk apparently uses key="value" format to find field(s) in your raw data. Since your value contains a quote, this quote delimits the value of the field. Depending on your data you might be able to define extraction catching the whole string if you can anchor the regex somewhere after that string. But as a general rule you should not have data containing unescaped delimiter.