×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
JunYamaguchi
Splunk Employee
Member since: ‎08-22-2024
‎08-22-2024
Community Statistics
Posts 1
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎08-22-2024
Activity Feed
Topics I've Started
No posts to display.
View All

Re: Windows event log Splunk HF with truncation

by Splunk Employee in Other Usage
‎08-22-2024 06:53 AM
‎08-22-2024 06:53 AM
This can be caused by syslog not supporting newlines(\n). The following settings on the HF will improve this. props.conf [your-sourcetype] TRANSFORMS-◯◯ = transname transforms.conf [transname] INGEST_EVAL = _raw=replace(_raw, "\n", " ") ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎08-22-2024 10:19 AM