Splunk Search

Missing Fields in events for specific log entries in a log file

skallaje
Engager

So, I have this following format for my log entries.

FIELD1-FIELD2-FIELD3-FIELD4-FIELD5-FIELD6

and logs are like ...
"abc"-"def"-"geh"-"hij"-"klm"-"Normal Message"
"abc"-"def"-"geh"-"hij"-""-"--HUGE JAVA STACK TARCE--"

The FIELDS column on the left side of the search page has all the "Selected Fields". The wide events section to the right of the fields column has the field names and the corresponding values underneath the events. But, FIELD6 is missing for the second event. I don't know why.

Could it be because the field value (for that particular second event) is extremely large? (you know, Java Stack trace spread over 100 lines). How do i get it to appear for the second event?

Tags (1)
0 Karma

somesoni2
Revered Legend

How are you extracting your fields?

0 Karma

GabrielTarget
Explorer

Howdy skallaje!

If you are suspicious that the trouble comes from your insanily huge event, there's a person who had a similar issue:

https://answers.splunk.com/answers/37381/dealing-with-omg-huge-events.html

Adding TRUNCATE = 0 in your props.conf should do the trick, I hope this solves your problem.

Regards!

0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...