i see the splunk query
index="sample" "log_processed.env"=prod "log_processed.app"=sample "log_processed.traceId"=90cf115a05ebb87b2
| table _time, log_processed.message
this is displaying the empty messages in a table cell . i could the event in the raw format.
do i have any limit to see the whole message in table box .
Hi @venugoski .. out of 23 events some events(as shown in the 3rd event in table output) may not have that particular "log_processed.message".
Lets doublecheck - pls check this one.. as the table command printing the _raw also, you can verify on same screen:
index="sample" "log_processed.env"=prod "log_processed.app"=sample "log_processed.traceId"=90cf115a05ebb87b2
| table _time log_processed.message _raw
hi @inventsekar Thank you ,
you are right, some events not have that particular "log_processed.message".
when i put | spath input=_raw i am seeing the events in table format but also seeing the duplicate events. can we avoid that.
index="sample" "log_processed.app"=mercury "log_processed.traceId"=dc57c0b7f0e8cfdee5002b62873f5de7 | spath input=_raw | table _time, log_processed.message
Drop spath. Splunk is already giving you field values. Adding spath as illustrated in your example will only give each field a duplicate value. When your log source is JSON, spath can be used to extract from a specific field that embeds an escaped JSON, or to extract value of a specific path. | spath input=_raw does neither.