Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Missing starting characters in a field
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Missing starting characters in a field
Hi ,
I am facing a strange issue like missing 2 starting characters in a field.My data is coming as a view from datawarehouse and its a a sql server .I am getting proper name in warehouse but not in splunk dashboard or search.Iam creating index using splunk db connect using the view .
I have "Name" field which has a value like "LL3CCCZM2" in warehouse , But is showing as 3CCCZM2 in splunk dashboard.
Can anyone help me to find the reason and rectify this in splunk please .
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Please provide the configuration you use to collect and parse the data and the search you are running that gives the broken results. Some screenshots would also be helpful (make sure to mask any sensitive data where needed).
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
DB connect Config as below :
Input Type:Batch Input
Max Rows to Retrieve :10000000
Fetch Size :default
The number of rows to return at a time from the database. Default is 300.
Timestamp
Current Index Time
Output Timestamp Format:yyyy-MM-dd HH:mm:ss
Execution Frequency:45 01 * * *
search :
index=DNS| fillnull value=others|search factor="" Group="" os="*"|search Status="Not Reporting"|Table Identifier,factor, Tag, hardware,Company, os,Group
Please help me to find the issue
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What is the actual DB query? Any props/transforms applied to extract fields?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It is actually a sql query with which the view is created .Nothing is set in props and transform etc .
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
May 2026 Splunk Expert Sessions: Security & Observability
Network to App: Observability Unlocked [May & June Series]
SPL2 Deep Dives, AppDynamics Integrations, SAML Made Simple and Much More on Splunk ...
