I have log data for a web service call. We log the web service call response status (success OR failure) as well as the payload that is send as request. These information (status and the payload) are logged in different lines. The payload huge XML data.
We would like to built the Splunk report base don the status and when the user click on the status we would like to display the Payload. This will help the user to diagnosis the issue in case of failure response.
We built the “multi-line” event so that we can have the “status” and the “payload” in the same event. This will help us in building the queries. But the challenge we face is that since the payload is huge the extraction fields that we created on the events are not showing up. We observe that the fields that are under the large data are not captured by the Splunk. But the field that we extracted on the top part of the data is showing up. Hence Splunk is NOT capturing the fields in an event after certain limit.
How can we resolve this issue?
↧