Splunk Search

Is there a way to change the order of the "stack_trace" attribute?

aroc725
Loves-to-Learn

Is there a way to change the order of the "stack_trace" attribute, so it shows up last within the log message ?

Labels (1)
0 Karma

aroc725
Loves-to-Learn

Just a quick follow-up: Is there a way to change the order by specifying the order of attributes within a log statement?

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@aroc725 - Can you please describe your question better? There seems like the context of the question is missing.

0 Karma

aroc725
Loves-to-Learn

What is happening is the "spath" splunk command only parsed the first 5000 characters. The "environment" field comes after that.

I would like to know if there is a way to force the "stack_trace" attribute to show up last in the log message.

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@aroc725 - I believe, It is not Splunk that is generating the logs here, so you should look into the system that is generating the logs.

From the Splunk side, if you wish to resolve the problem, you can increase the spath, extraction_cutoff limit from limits.conf.

 

I hope this helps!!!

0 Karma

aroc725
Loves-to-Learn

Thanks for taking the time to respond, VatsalJagani.

Is there any way to set those limits at the individual application/service level ?

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@aroc725 - limits.conf is system level conf file so no way to set application/user level.

 

I hope this helps!!!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...