Splunk Search

Missing Fields in events for specific log entries in a log file

skallaje
Engager

So, I have this following format for my log entries.

FIELD1-FIELD2-FIELD3-FIELD4-FIELD5-FIELD6

and logs are like ...
"abc"-"def"-"geh"-"hij"-"klm"-"Normal Message"
"abc"-"def"-"geh"-"hij"-""-"--HUGE JAVA STACK TARCE--"

The FIELDS column on the left side of the search page has all the "Selected Fields". The wide events section to the right of the fields column has the field names and the corresponding values underneath the events. But, FIELD6 is missing for the second event. I don't know why.

Could it be because the field value (for that particular second event) is extremely large? (you know, Java Stack trace spread over 100 lines). How do i get it to appear for the second event?

Tags (1)
0 Karma

somesoni2
Revered Legend

How are you extracting your fields?

0 Karma

GabrielTarget
Explorer

Howdy skallaje!

If you are suspicious that the trouble comes from your insanily huge event, there's a person who had a similar issue:

https://answers.splunk.com/answers/37381/dealing-with-omg-huge-events.html

Adding TRUNCATE = 0 in your props.conf should do the trick, I hope this solves your problem.

Regards!

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...