Splunk Search

Build Event Type search char limitation

vlapeintuit
Explorer

I am creating several event types and have found when adding searches longer than 98 char it trims the rest off. Is there a way to increase the char limit for the field? Here is an example of a search string

index="****" sourcetype="***********" "**********************" AND "********" AND "************** <******>"

I get cut off at the <.

(actual text replaced with *)

Splunk version 4.1.5 build 85165

Tags (1)
0 Karma

Ron_Naken
Splunk Employee
Splunk Employee

I can't reproduce the issue. I am using the following builds of Splunk:

Splunk version 4.1.4 build 82143
Splunk version 4.1.6 build 89596

I tried with a 111-character search, as well as your sample with the *'s replaced by text.

Are you running Firefox, or another browser? I'm using Firefox 3.6.4

0 Karma
Get Updates on the Splunk Community!

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...