https://community.splunk.com/t5/Getting-Data-In/How-to-configuring-Splunk-to-not-truncate-scripted-input-running/m-p/595680#M104044 <P>Obviously, the problem is not with Splunk truncating events or the TRUNCATE setting would make a difference and you would see truncate messages in the log.</P><P>Verify the script is running correctly by saving its output to a file and examining the file.</P><P>If the file is good, use the Add Data wizard to load it into Splunk and check that events are breaking where they should.&nbsp; Adjust the settings in the wizard as necessary to get events to load completely.&nbsp; Then save those settings in the props.conf file for the sourcetype.</P> Thu, 28 Apr 2022 00:58:45 GMT richgalloway 2022-04-28T00:58:45Z https://community.splunk.com/t5/Getting-Data-In/How-to-configuring-Splunk-to-not-truncate-scripted-input-running/m-p/595643#M104035 <P>I've got a scripted input running on a universal forwarder that generates json output to the tune of 18,000+ lines.&nbsp; However, when I query for its events in the Splunk search, it shows only 13 lines per event.</P> <P>&nbsp;</P> <LI-CODE lang="markup">{ "apiVersion": "v1", "items": [ { "apiVersion": "apps/v1", "kind": "Deployment", "metadata": { "annotations": { "deployment.kubernetes.io/revision": "1", "field.cattle.io/publicEndpoints": "myPublicEndpoint1", "meta.helm.sh/release-name": "myrelease1", "meta.helm.sh/release-namespace": "mynamespace1" },</LI-CODE> <P>&nbsp;</P> <P>&nbsp;I've tried setting TRUNCATE to both 0 and 1000000 in props.conf for the scripted input's sourcetype ("scriptedinput1") on both the universal forwarder and the search instances and restarted the services, but the truncating remains the same.</P> <P>&nbsp;</P> <LI-CODE lang="markup">[scriptedinput1] KV_MODE=json TRUNCATE=1000000</LI-CODE> <P>&nbsp;</P> <P>I should also note that I'm not seeing "truncating" anywhere in my splunkd.log on the universal forwarder and search instances.&nbsp; Any assistance with configuring Splunk to not truncate my scripted input running on the universal forwarder would be greatly appreciated.</P> Wed, 27 Apr 2022 21:49:06 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configuring-Splunk-to-not-truncate-scripted-input-running/m-p/595643#M104035 bsg273 2022-04-27T21:49:06Z https://community.splunk.com/t5/Getting-Data-In/How-to-configuring-Splunk-to-not-truncate-scripted-input-running/m-p/595680#M104044 <P>Obviously, the problem is not with Splunk truncating events or the TRUNCATE setting would make a difference and you would see truncate messages in the log.</P><P>Verify the script is running correctly by saving its output to a file and examining the file.</P><P>If the file is good, use the Add Data wizard to load it into Splunk and check that events are breaking where they should.&nbsp; Adjust the settings in the wizard as necessary to get events to load completely.&nbsp; Then save those settings in the props.conf file for the sourcetype.</P> Thu, 28 Apr 2022 00:58:45 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configuring-Splunk-to-not-truncate-scripted-input-running/m-p/595680#M104044 richgalloway 2022-04-28T00:58:45Z