I have some new logs coming in, and I took a look at the fieldname that has a Windows filename in it, and it is being truncated after the space character (if there happens to be one).
The events are coming in via DB Connect, multiline, and I can see the whole filename in the _raw event:
event_guid=ABDC1234-EE33-43F3-ABCDEF file_size=3432342 source_file=//home.local/home/caddev/usernameish/temp deck overview.pptx target_path=
So the event is indexing fine, but when I search, and Splunk does it's generic field extraction, the source_file field turns into:
Is there a quick way to fix this?
you need to build the extraction for that. A quick way is to use the extract fields in the event actions.
Check these splunk docs: