stats count by <Field> : Field value not fully displaying in screen

[binurajps]

Below are my log entry 

DateTime=2020-12-16 14:19:01:888 UTC, Type=Orchestrator Event Log, Environment=prod, Thread=[Processor-ENSDelivery-PRODOCSNotification001-5], Logger=com.expedia.www.orchestrator.service.OrchestratorProcessor Message=[Email_TransactionStatus=SUCCESS, OrchestrationStatus=WWW_Template, FallBackStatus=MODULE_BUILDER_FAILED, FallBackReason=LxVirtualCurrencyRefundAmount and LXCreditCardRefundAmount both are null or empty]

This is my splunk query 

index=app splunk_server_group="bexg*" sourcetype=orchestrator-service* NOT "url=/isActive" NOT "Logger=com.netflix.servo.publish.JmxMetricPoller" Email_TransactionStatus FallBackStatus=MODULE_BUILDER_FAILED | stats count by FallBackStatus, FallBackReason

It shows like below

FallBackStatus                                           FallBackReason                                                       Count

MODULE_BUILDER_FAILED                 LxVirtualCurrencyRefundAmount                   1

My expected output

FallBackStatus                                           FallBackReason                                                       Count

MODULE_BUILDER_FAILED               LxVirtualCurrencyRefundAmount and LXCreditCardRefundAmount both are null or empty                   1

It seems the mentioned case FallBackReason filed value getting cropped.

[binurajps]

Your help much appreciated and it would be great if you can suggest me how can I change my query? 

[binurajps]

Thanks for your help. It would be great if you can modify below query

index=app splunk_server_group="bexg*" sourcetype=orchestrator-service* NOT "url=/isActive" NOT "Logger=com.netflix.servo.publish.JmxMetricPoller" Email_TransactionStatus FallBackStatus=MODULE_BUILDER_FAILED | stats count by FallBackStatus, FallBackReason

[richgalloway]

You'll have to parse the event yourself.

index=app splunk_server_group="bexg*" sourcetype=orchestrator-service* NOT "url=/isActive" NOT "Logger=com.netflix.servo.publish.JmxMetricPoller" Email_TransactionStatus FallBackStatus=MODULE_BUILDER_FAILED 
| rex "FallBackReason=(?<FallBackReason>[^,]+)"
| stats count by FallBackStatus, FallBackReason

[richgalloway]

By default, Splunk will parse key=value log formats automatically, but it assume the value field ends at the first space.  The solution (other than modifying the logger) is to use a custom configuration to parse the log.

Start with these props:

[mysourcetype]
TIME_PREFIX = DateTime=
TIME_FORMAT = %Y-%m-%d %H:%M:%S:%3N %Z
MAX_TIMESTAMP_LOOKAHEAD = 27
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)
TRANSFORM-parser = mysourcetypeparser

Then in transforms.conf:

[mysourcetypeparser]
REGEX = ([^=]+)=([^,]+)
FORMAT = $1::$2