Blank Character in string

[rafamss]

Hi,

I have a index configured to get data from a database MSSQL. Well, The data are be obtained with sucess but one column have a string with various blank spaces inside her. When I do my query in Splunk, I don't see the complete string.

Example of content of the String Field: Error in the database. Contact the admin.

I see in Splunk the content of column, in Search , but I don't can find the content by query like a parameter by example.

Example:

index="my index" StringField="Error in the database. Contact the admin."

The result of this query don't return anything. But there are data with this parameter in index.

What I can do ?

Thanks an advance,

RM

[rafamss]

Hi Hiroshi,

Interesting! But in my Search query, it isn't works. See the images below.

In the first image, the search query return my search; In the second image, the left side panel don't shows my search query and in the third image, the search query, I aggregates the search query using the stats command, but in the panel Statistics, doens't show this.

What do you think ?

Image 1

Image 2

[rafamss]

I can't insert the third image, sorry.

[HiroshiSatoh]

I think that it has failed to field extraction. I think that it needs re-definition of the field.

[rafamss]

I think too. I'll verify this and return. Tks!

[HiroshiSatoh]

I can search so, cause you can not find it I think is in the other.