Also, it wont do it if I try: | fields yyy_zzz no results So its not the second underscore... Im not sure what it is, kinda baffled. ... View more

As an update, I have discovered something. Here is an example of the kpi I am trying to read in Python with the dots: xxx.yyy.zzz.aaa I've found if I dont include it in the search and just search by sourcetype and then in the fields list in the query, I put something like xxx_yyy* I will get some results. (note, using underscore seems to be the only way to get fields with dots in them using python) ...so you'd think I could do : | fields xxx_yyy_zzz_aaa right? Nope. The first time another underscore is included, it doesnt return the field. This isn't the best solution but its something I may be able to work with. Anyone know why when the second underscore is included, it would return the kv pair? ... View more

Here is more bizarre behavior which may point to a solution too. When I put single quotes around the kpis with periods, I go no results back at all. When I dont have the single quotes, I get results back. So it seems Splunk is seeing these kpis yet when I try to print them out to see them myself, they are not there. And when I run the query with a | stats count, I get the expected number of results and when I allow it to print the _raw, I see the expected kpis with periods with the values after them. (thinking emoticon) So the break in the processing happens from taking what the reader function in Python retrieved and printing/saving it so it can be used for calculations and reporting ... View more

I have tried the single quotes, to no avail. I guess I could try to escape the periods, but I am not using regex so I am unsure that will work. And I have taken your advice already and written a tiny query script to see if I can figure this out, yeah. Nothing works so far. I get all fields that are standard from splunk and none of the ones with the periods. ... View more

So, to be clear, when I run the query in Splunk Web, I do see the fields with the periods in their entirety with no problem so I dont think ingestion broke anything. And when I view the fields on the left hand sidebar in Splunk Web, they are listed with underscores instead of periods. I tried this in Python and it didn't recognize them. Do you still think its possible they broke ingestion even if I can see the entire fields in Splunk Web and not when querying with Python? ... View more

As a side note, if I allow the query to retrieve the _raw field, I see the raw field, with the fields with the periods in it and the correct values but the fields (with periods) I explicitly asked for in my query I do not see listed from reader input. ... View more

Thank you for replying. Do you find there is a problem with the method I proposed? I would like to be able to avoid changing anything on the original virtual index that way I can test to see if the newly named virtual index is running correctly before doing anything that might affect the working virtual index. Thanks ... View more

Weird, I wonder why my version isn't working. thanks. ... View more

Yes each one returns individual results. ... View more

I did find a workaround so I will post my workaround and accept that. Your suspicion about the 6-digit integer causing a silent overflow sounds very close what it might be. The reason I say this is because both on my Python script and my PHP script, the values that were being halted were in that 140,7... or 141,7... range although now that I think about it too there was another one in my Python script that was smaller than wouldn't ingest so I don't know. I am using the "." operator to concatenate in PHP and was using the "+" operator to concatenate in Python. The PHP code seems to ingest easier. Thanks for your help. ... View more

Transforms List: Thats a little too long to post here (actually 9900 characters long to be exact) Props List: That is also too long by even more characters... Is there something in specific I can look for? ... View more

I think I have found a workaround. Its not pretty but it works for our purposes and retains the functionality of stats and other mathematical operations in Splunk. Since the one particular kv pair requires me to add 3 digits to it for it be ingested, I simply added 3 zeroes to the front of it. So now it ingests and and it retains its computational integrity in Splunk. I have to ingest two more scripts after the holiday so hopefully those will go in smoothly. Not really sure who to award these karma points to since no one really answered in the correct answer section. ... View more

Sure. This is what the text output: FOO_TO_BAR_bw=42633986553287 FOO_FROM_BAR_bw=14247833943534 FOO_TO_BLUE_bw=319351982811404 FOO_FROM_BLUE_bw=164771268078805 The output to Splunk didn't exist. The value "FOO_FROM_BAR_bw" is the cultprit. Beacuse those are all on one line, since that once doesn't ingest, the whole line doesn't ingest. ... View more

Well I tried to do stats functions on the values when they were strings with the quotes on them and it didn't seem to work. Plus, my boss has told me I need should ingest them without the quotes around them but I can possibly convince him otherwise if I absolutely have to. I have only one value from the PHP scripts which will not ingest unless I concatenate at least 3 digits to it, so I am so close to completion. ... View more

In answer to your first part, yes, I have been ingesting them individually and theres a particular one that won't ingest, but I dont see any difference between its value and the others. Your other idea might be plausible though yet, I would be concerned about eventual growth of the size of the log file its creating - I'd have to have it on rotation. Thanks for the ideas. With the PHP version of the script, I only have one of the metrics left that refuses to ingest. ... View more

Apparently, itll ingest when I concatenate a minimum of three numbers to it. Only numbers. If I try to concatenate two it refuses to ingest. Im completely baffled. ... View more

So, this gets even more mysterious. I rewrote the entire script in PHP thinking it was a Python issue and the values I calculated Splunk STILL would not ingest. :( Oddly enough If I concatenate the value onto itself in PHP it will ingest. So, kv1=14202560152091 will not ingest but kv1=1420256015209114202560152091 does. It makes absolutely no sense. ... View more

Please try to answer as an official answer so that when a solution is found I can award the karma points. ... View more

So, so far, it seems I can ingest these values as: Strings with quotes (ie. kv1="83273791379381937") Hexidecimal values Scientific numbers It refuses to ingest them as: Integers Strings without quotes I need them to be ingested as strings without quotes. Just an update. back to the drawing board. ... View more

@niketnilay Thanks for the suggestion, it will indeed process the value as hex and display it but as per my use case is to use the PHP API to retrieve these values via a report. I dont think its acceptable for me to leave them in there are hex numbers and then transform them in the PHP API report we're creating I need them to be ingested as strings (without quotes). 😞 I even tried converting it back from hex to integer to string before ingesting and it refuses that value. ... View more

A sample of my code exists in a comment below. ... View more