Splunk Search

Missing Fields in events for specific log entries in a log file

skallaje
Engager

So, I have this following format for my log entries.

FIELD1-FIELD2-FIELD3-FIELD4-FIELD5-FIELD6

and logs are like ...
"abc"-"def"-"geh"-"hij"-"klm"-"Normal Message"
"abc"-"def"-"geh"-"hij"-""-"--HUGE JAVA STACK TARCE--"

The FIELDS column on the left side of the search page has all the "Selected Fields". The wide events section to the right of the fields column has the field names and the corresponding values underneath the events. But, FIELD6 is missing for the second event. I don't know why.

Could it be because the field value (for that particular second event) is extremely large? (you know, Java Stack trace spread over 100 lines). How do i get it to appear for the second event?

Tags (1)
0 Karma

somesoni2
Revered Legend

How are you extracting your fields?

0 Karma

GabrielTarget
Explorer

Howdy skallaje!

If you are suspicious that the trouble comes from your insanily huge event, there's a person who had a similar issue:

https://answers.splunk.com/answers/37381/dealing-with-omg-huge-events.html

Adding TRUNCATE = 0 in your props.conf should do the trick, I hope this solves your problem.

Regards!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...