Splunk Search

Retain special characters at the end of field value


I have an ID among other things that is extracted by Splunk DB Connect from a mySQL database.  Whats special with the ID is that it ends with 3 equal signs:


I`m required to put this value into a summary index in order to make it available for a search head outside the cluster where it is indexed and when it is written to the summary index everything appears good and the value is written as is with the 3 equal signs.

However, when I search for the field _raw will display the value as it is written but when I list it in either a table or with a transform command the equal signs have been removed and I need this value to be exact as I later need to compare it in order to join data.  As the value always appears with 3 equals sign I have temporarily rtrim() on the source I am comparing it to but it really bugs me that the characters gets removed.

PS: Extracting it from one Splunk server to another by the API is sadly not an option due to network limitations.

Labels (3)
0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...