https://community.splunk.com/t5/Getting-Data-In/JSON-is-truncated-as-soon-a-timestamp-is-found/m-p/393628#M70277 <P>I'm trying to read a json file generated by a ps1 script on Windows, but the UF keep truncating the json as soon it finds a valid timestamp. Removing the timestamp 'fixes' the problem, but I need the timestamps. I've a similar script running on unix machine and the issues is not appearing there. My props is the following:</P> <PRE><CODE>[sourcetype_name] TRUNCATE = 0 BREAK_ONLY_BEFORE_DATE = false DATETIME_CONFIG = NONE MAX_TIMESTAMP_LOOKAHEAD = 0 INDEXED_EXTRACTIONS = JSON </CODE></PRE> <P>I'm starting to think that it's a bug on Windows UFs.</P> Tue, 09 Apr 2019 09:35:07 GMT nicolociraci 2019-04-09T09:35:07Z https://community.splunk.com/t5/Getting-Data-In/JSON-is-truncated-as-soon-a-timestamp-is-found/m-p/393628#M70277 <P>I'm trying to read a json file generated by a ps1 script on Windows, but the UF keep truncating the json as soon it finds a valid timestamp. Removing the timestamp 'fixes' the problem, but I need the timestamps. I've a similar script running on unix machine and the issues is not appearing there. My props is the following:</P> <PRE><CODE>[sourcetype_name] TRUNCATE = 0 BREAK_ONLY_BEFORE_DATE = false DATETIME_CONFIG = NONE MAX_TIMESTAMP_LOOKAHEAD = 0 INDEXED_EXTRACTIONS = JSON </CODE></PRE> <P>I'm starting to think that it's a bug on Windows UFs.</P> Tue, 09 Apr 2019 09:35:07 GMT https://community.splunk.com/t5/Getting-Data-In/JSON-is-truncated-as-soon-a-timestamp-is-found/m-p/393628#M70277 nicolociraci 2019-04-09T09:35:07Z