Why are Interesting Fields not yielding complete values in the search result?

[muguniya]

Hi,

When a blank space is introduced in values, the search results are not yielding complete values. Please see details below.

Event in Splunk looks like:

id=43777924d6-fda8-4c2b-9884-2f85c6f84b4e
queryType=join
accountName=Test Acc
anchor=
applicationName=Test Application
siteName=PUSH to Test Site

My current search and result using the table command:

index=db-general source="dbmon-tail://Logging*" | table accountName,applicationName,siteName

Actual Search Result in Table format does not have complete values for accountName, applicationName, siteName:

accountName    applicationName    siteName↕ 
Test           Test               PUSH  

Expected result should be as shown below:

accountName    applicationName    siteName
Test Acc       Test Application   PUSH to Test Site

Any help in this regard is much appreciated.

Thanks.

[vinitatsky]

http://answers.splunk.com/answers/49390/field-with-single-value-but-value-has-spaces.html
I hope this helps.

Also you can check if 'accountNameWithSpace' is giving correct value (with spaces)

field=_raw "accountName=(?P[\S\s]+)"