Splunk Search

Retain special characters at the end of field value

okheggdal
Explorer

I have an ID among other things that is extracted by Splunk DB Connect from a mySQL database.  Whats special with the ID is that it ends with 3 equal signs:

XXXXXXXX===

I`m required to put this value into a summary index in order to make it available for a search head outside the cluster where it is indexed and when it is written to the summary index everything appears good and the value is written as is with the 3 equal signs.

However, when I search for the field _raw will display the value as it is written but when I list it in either a table or with a transform command the equal signs have been removed and I need this value to be exact as I later need to compare it in order to join data.  As the value always appears with 3 equals sign I have temporarily rtrim() on the source I am comparing it to but it really bugs me that the characters gets removed.

PS: Extracting it from one Splunk server to another by the API is sadly not an option due to network limitations.

Labels (3)
0 Karma
Get Updates on the Splunk Community!

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...