Are you a member of the Splunk Community?
- Find Answers
- :
- Premium Solutions
- :
- Splunk Enterprise Security
- :
- Re: Field Extractor
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
The field extractor stops at line 20. If what I am looking for is on a line after that what can I do to pull that information?
I have looked for other threads to no avail. If one exists please by all means point me in that direction.
Thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
So it turns out I was wrong, before, so I deleted my previous response. I don't know what was going on before but now I am also in your same position. I looked it up further and it turns out lots of people are having this issue, as well. For some reason, it is capped at 20, and there doesn't seem to be a way around it without extracting it manually, in the search. I'll let you know if I actually find something.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ya I realize the parsing could/should be better but unfortunately I don't have that type of administrative control.
Capping it at 20 lines makes no sense at all.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I came across an app yesterday that someone made for download at Splunkbase that allows the field extractor to be more customizable. However, it is not made by Splunk, so I wouldn't download it myself. Let me know if you find a solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
So it turns out I was wrong, before, so I deleted my previous response. I don't know what was going on before but now I am also in your same position. I looked it up further and it turns out lots of people are having this issue, as well. For some reason, it is capped at 20, and there doesn't seem to be a way around it without extracting it manually, in the search. I'll let you know if I actually find something.
What’s New & Next in Splunk SOAR
Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud
Update Your SOAR Apps for Python 3.13: What Community Developers Need to Know
