Custom field from an event is not being parsed correctly

[bilalzaib]

Hi, We are using the event field message in our alert, but in some cases, the field is not being parsed correctly. For example, in the attached screenshot, the source event contains the full text in raw format, i.e., message="The full message". However, when we check the Event under the Action tab, it only shows the first word of the message — "The" — which results in incorrect information being sent in alerts.

Could someone please help us resolve this issue? I appreciate any help you can provide.

[bilalzaib · Accepted solution]

The logs are coming from a Django application, and the sourcetype is set to the name of the application (as shown by | metasearch sourcetype=* command). This is how we are sending logs from the application

logger.info('Carrier updates summary; message="The following updates message", user="john_doe", carrier_slug="example_carrier"')

We are using below query for extraction

((host="*.prod.domain.com" "Carrier updates summary;") 
OR 
(index=prod_index_eks kub.pod_name="domain-*" log="*Carrier updates summary;*"))
| eval message=coalesce(message, log)
| table message

I hope this provides some context about our logs. Apologies if it doesn’t — I’m still very new to Splunk. I really appreciate your help!

[ITWhisperer]

Assuming you have admin access, you can find the source types under the settings menu option. From this you can find out what extractions are configured, as I suspect these aren't dealing with your custom field as you expect.

You could also try using the extract command

((host="*.prod.domain.com" "Carrier updates summary;") 
OR 
(index=prod_index_eks kub.pod_name="domain-*" log="*Carrier updates summary;*"))
| extract
| eval message=coalesce(message, log)
| table message

[ITWhisperer]

What sourcetype and extraction configuration are you using?