Have a field in our HEC input that is larger the 10,000 characters. When searching the data input from HEC the field is has not been extracted. It is in _raw and I can pull it out of there. Really would like to be able to have the field extracted.
props.conf has:
TRUNCATE = 0
I can manually input the same data via a text file and the large field (a blob of JSON text) is extracted and available fine. Just not when input via HEC.
See screen shots
If sending into HEC using the event not raw endpoint in JSON.
Set KV_MODE = JSON on the props for that sourcetype. NOT auto...
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf?splunkbot
If sending into HEC using the event not raw endpoint in JSON.
Set KV_MODE = JSON on the props for that sourcetype. NOT auto...
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf?splunkbot
Adding this to props.conf fixed the issue:
[nm_MobileDiagnosticsReportData]
KV_MODE = json
Hi,
Canyou increase the maxchars in limits.conf and try.
https://docs.splunk.com/Documentation/Splunk/7.2.4/Admin/Limitsconf
Sid
When the events are inserted via HEC running a fieldsummary DOES NOT show report field. When the same raw event is input via a file fieldsummary DOES show report field.
i'll ask the dumb question...is the report field in the "3 more fields" link?
No the report field is not listed.