I have an ID among other things that is extracted by Splunk DB Connect from a mySQL database. Whats special with the ID is that it ends with 3 equal signs:
XXXXXXXX===
I`m required to put this value into a summary index in order to make it available for a search head outside the cluster where it is indexed and when it is written to the summary index everything appears good and the value is written as is with the 3 equal signs.
However, when I search for the field _raw will display the value as it is written but when I list it in either a table or with a transform command the equal signs have been removed and I need this value to be exact as I later need to compare it in order to join data. As the value always appears with 3 equals sign I have temporarily rtrim() on the source I am comparing it to but it really bugs me that the characters gets removed.
PS: Extracting it from one Splunk server to another by the API is sadly not an option due to network limitations.
