Splunk Search

return _raw of a large file

simon007
Observer

I am using the | fields _raw to show the entire content of the source file as a single event.  It works for most of my log files less than 100K.  For occasionally larger files, the search will break the results into multiple events and missing out the details.  How can I fix it?  Or is there another way to return the file contents?  I know users can click on the Show Source in the event action, but my search queries are part of a dashboard drilldown on file names.

Labels (1)
0 Karma

marnall
Motivator

Using "| fields _raw" should not remove information from the raw data recorded from the file into the event, it should only remove the extracted fields from your search results. If the missing details are not in the extracted fields, and are not present in the events before applying "| fields _raw" but are present in the files, then there could be a problem with indexing the content of the file into events.

Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...