Splunk Search

Retain special characters at the end of field value


I have an ID among other things that is extracted by Splunk DB Connect from a mySQL database.  Whats special with the ID is that it ends with 3 equal signs:


I`m required to put this value into a summary index in order to make it available for a search head outside the cluster where it is indexed and when it is written to the summary index everything appears good and the value is written as is with the 3 equal signs.

However, when I search for the field _raw will display the value as it is written but when I list it in either a table or with a transform command the equal signs have been removed and I need this value to be exact as I later need to compare it in order to join data.  As the value always appears with 3 equals sign I have temporarily rtrim() on the source I am comparing it to but it really bugs me that the characters gets removed.

PS: Extracting it from one Splunk server to another by the API is sadly not an option due to network limitations.

Labels (3)
0 Karma
Get Updates on the Splunk Community!

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...

Splunk Cloud Platform | New Customer Testimonials

Enterprises of all sizes and across different industries are accelerating cloud adoption by migrating ...