Field data ends with elipsis...how do I get the rest?

[claatu]

I do a search query where one of the fields returned has semicolon-separated values. For example, "Alpha;Beta;delta". The field sometimes has a large number of values, and the last one ends with dot-dot-dot, for example: ";blue;red..."

I know from the source feeding this that the field has more values than are being shown in Splunk. So I think Splunk is just truncating and not showing the rest of the values. Is it possible to get the full amount of data, or is that being truncated at the point of the feed? Is there a solution to this?

[DalJeanis · Accepted solution]

One way to test this is

 your search that gets some of these
 | head 5 
 | makemv myfield delim=";"
 | mvexpand myfield

That will take the first five records, change that field into an official multivalue field, then fan out the records so that there is one record per value in that field, with the remainder of fields retained.

Once you review those, you will know whether the data is still there.

[claatu]

Have already done that. That is how I know for sure that the list of items is incomplete.

[claatu]

OK, We can close this question. I saw the details of the feed mechanism, where it states: "These fields are limited to 1250 characters. If such a field has been truncated, the field's value will end with an ellipsis ("...")."

So, I guess there is no getting the full data, as it is not even making it into Splunk.

Thanks for considering it.