Splunk Search

return _raw of a large file

simon007
Observer

I am using the | fields _raw to show the entire content of the source file as a single event.  It works for most of my log files less than 100K.  For occasionally larger files, the search will break the results into multiple events and missing out the details.  How can I fix it?  Or is there another way to return the file contents?  I know users can click on the Show Source in the event action, but my search queries are part of a dashboard drilldown on file names.

Labels (1)
0 Karma

marnall
Builder

Using "| fields _raw" should not remove information from the raw data recorded from the file into the event, it should only remove the extracted fields from your search results. If the missing details are not in the extracted fields, and are not present in the events before applying "| fields _raw" but are present in the files, then there could be a problem with indexing the content of the file into events.

Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...