Splunk Search

Retain special characters at the end of field value

okheggdal
Explorer

I have an ID among other things that is extracted by Splunk DB Connect from a mySQL database.  Whats special with the ID is that it ends with 3 equal signs:

XXXXXXXX===

I`m required to put this value into a summary index in order to make it available for a search head outside the cluster where it is indexed and when it is written to the summary index everything appears good and the value is written as is with the 3 equal signs.

However, when I search for the field _raw will display the value as it is written but when I list it in either a table or with a transform command the equal signs have been removed and I need this value to be exact as I later need to compare it in order to join data.  As the value always appears with 3 equals sign I have temporarily rtrim() on the source I am comparing it to but it really bugs me that the characters gets removed.

PS: Extracting it from one Splunk server to another by the API is sadly not an option due to network limitations.

Labels (3)
0 Karma
Get Updates on the Splunk Community!

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...

AI Adoption Hub Launch | Curated Resources to Get Started with AI in Splunk

Hey Splunk Practitioners and AI Enthusiasts! It’s no secret (or surprise) that AI is at the forefront of ...