Why won't eval substr is work with large string of 20k characters?

[RJDev]

Hi, I am new to Splunk. I just started using it last month. For me the below 
" | eval error=substr(msg, 0, 1000) |  table error app_name"    is not working  with my alert event.

It doesn't work for large strings with 20k or more characters. The table cells show blank in this case. But values can be found in verbose mode but in fast mode.

However it works when the msg is of ~1150 characters.

[bowesmana]

Does the makeresults example work in your instance? If so, it would appear that the 20k is not an issue?

If it works, then there is one thing that may be relevant. If your field is a multivalue field, then it substr will not work.

[kamlesh_vaghela]

@RJDev 

I think it should work. I've check by using below search. You can try it.

| makeresults count=1
| eval error="abcdefghijklmnopqrstuvwxyz abcdefghijklmnopqrstuvwxyz abcdefghijklmnopqrstuvwxyz abcdefghijklmnopqrstuvwxyz" 
| foreach 1,2,3,4,5,6,7,8,9,10 
    [| eval error=error.error]
| eval erro_new=substr(error, 0, 1000)
| eval error_c = len(error)
| eval erro_new_c = len(erro_new)

 

Thanks
KV


If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

[gcusello]

Hi @RJDev,

It's really stronge, it's the first time I see an issue like this, anyway, you could try to use the rex command maybe it hasn't the same limit:

| rex field=msg "^(?<error>.{1000})"

Ciao.

Giuseppe 

[RJDev]

Hi @gcusello ,

I just have tried your suggestion,

| rex field=msg "^(?<error>.{1000})"  | table field

However it didn't work. 

[gcusello]

Hi @RJDev,

yes, as @bowesmana hinted:

| rex field=msg "^(?<error>.{1000})"
| table error

Ciao.

Giuseppe

[bowesmana]

Did you mean 

... | table error

You are extracting error with the rex command, not field

[RJDev]

Hi @bowesmana ,

I tried that too. 

| rex field=msg "^(?<error>.{1000})"  | table error

Still no luck.

[RJDev]

Hi @gcusello Thanks for replying.

Apologies for delayed response. 

Will definitely give this a try shortly and let you know