Splunk Search

Problem to indexer a multivalue field too longer

adolfus1982
New Member

Hi everybody
Trying to index a multivalue field with more than 6000 characters approx. With the same sourcetype we have two behaviour: If the length of that field is minor than 6000 it's indexed correctly, nevertheless if that field is greater than 6000 is being saved just the first element removing the rest of that field and stopping indexing the rest of the fields.

For example if event contains the follow info :
field1:"1231644", field2:"64614",field3:"sdfeee", field4:"ghdddfgd", field5:"1616",field6:"1231644",
field7:"xxxxxx1, xxxxxxx,xxxxxx2, xxxxxx3, xxxxxx4,xxxxxxx, xxxxxxx, xxxxxxx,xxxxxxx, xxxxxxx, xxxxxxx,xxxxxxx, xxxxxxx......xxxx12158",field8:"464641", field9:"7416",

When I extract info, it shows :
field1:1231644
field2:64614
field3:sdfeee
field4:ghdddfgd
field5:1616
field6:1231644
field7:"xxxxxx1
date:
index

So field8 ,field9 and following aren´t

Tags (1)
0 Karma

techiesid
SplunkTrust
SplunkTrust

Hello,

Can you check the the props.conf config file for that sourcetype and see whether there is any settings for TRUNCATE.

TRUNCATE = <non-negative integer>
* The default maximum line length, in bytes.
* Although this is in bytes, line length is rounded down when this would
  otherwise land mid-character for multi-byte characters.
* Set to 0 if you never want truncation (very long lines are, however, often
  a sign of garbage data).
* Default: 10000

https://docs.splunk.com/Documentation/Splunk/8.0.0/Admin/Propsconf

Sid

0 Karma

adolfus1982
New Member

In props.conf has no TRUNCATE, and the default value of 10000 is greater than the length of my data:

Content of this file is:

```
[source::.../.txt]
EXTRACT-codproceso=\/(?[\d]+)\s in source
EXTRACT-proceso=\s(?[a-zA-ZñÑáéíóúÁÉÍÓÚçÇ\s]+)[\d-_]
.txt in source
EXTRACT-fichero=.*\/(?[^\n]+) in source
EXTRACT-codusr=(?[^\@]+) in EMAIL_USU

[mxp_agentes]
EXTRACT-fecactu = (?\d{8}) in NUM_REF_AGN

[mxp_transfer]
EVAL-_time = strptime(timestamp_path,"%Y/%m/%d")

[host::IDX_lugar]
TRANSFORMS-routing=routing_mexico
```

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...