Is there a way to change the order of the "stack_trace" attribute?

[aroc725]

Is there a way to change the order of the "stack_trace" attribute, so it shows up last within the log message ?

[aroc725]

Just a quick follow-up: Is there a way to change the order by specifying the order of attributes within a log statement?

[VatsalJagani]

@aroc725 - Can you please describe your question better? There seems like the context of the question is missing.

[aroc725]

What is happening is the "spath" splunk command only parsed the first 5000 characters. The "environment" field comes after that.

I would like to know if there is a way to force the "stack_trace" attribute to show up last in the log message.

[VatsalJagani]

@aroc725 - I believe, It is not Splunk that is generating the logs here, so you should look into the system that is generating the logs.

From the Splunk side, if you wish to resolve the problem, you can increase the spath, extraction_cutoff limit from limits.conf.

I hope this helps!!!

[aroc725]

Thanks for taking the time to respond, VatsalJagani.

Is there any way to set those limits at the individual application/service level ?

[VatsalJagani]

@aroc725 - limits.conf is system level conf file so no way to set application/user level.

I hope this helps!!!