https://community.splunk.com/t5/Splunk-Search/How-to-prevent-tstats-from-truncating-large-fields/m-p/585878#M204104 <P>"Accelerated fields have a limitation of 1024 bytes per entry, so you cannot use fields that have more than 1024 bytes"<BR /><BR /><A href="https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/kvstore/usingconfigurationfiles/" target="_blank">https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/kvstore/usingconfigurationfiles/</A></P> Mon, 21 Feb 2022 00:27:42 GMT schplunk_meiste 2022-02-21T00:27:42Z https://community.splunk.com/t5/Splunk-Search/How-to-prevent-tstats-from-truncating-large-fields/m-p/409584#M118160 <P>I have an accelerated data model with a field with large strings in it.<BR />When I use the spl</P> <PRE><CODE>| data model dm_name ds_name search | table * </CODE></PRE> <P>I can see the whole fields.</P> <P>When I use tstats:</P> <PRE><CODE>| tstats latest (_time) as _time latest (ds_name. data) as data from datamodel=dm_name.ds_name where (nodename = ds_name) groupby ds_name. id prestats=true </CODE></PRE> <P>the data fields are truncated.</P> <P>I tried to change [stats] maxvaluesize in limits.conf without success. There seems to be no such config for tstats.</P> <P>How can I prevent tstats from truncating large fields?</P> Tue, 22 Feb 2022 15:02:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-prevent-tstats-from-truncating-large-fields/m-p/409584#M118160 rhobby 2022-02-22T15:02:54Z https://community.splunk.com/t5/Splunk-Search/How-to-prevent-tstats-from-truncating-large-fields/m-p/585878#M204104 <P>"Accelerated fields have a limitation of 1024 bytes per entry, so you cannot use fields that have more than 1024 bytes"<BR /><BR /><A href="https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/kvstore/usingconfigurationfiles/" target="_blank">https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/kvstore/usingconfigurationfiles/</A></P> Mon, 21 Feb 2022 00:27:42 GMT https://community.splunk.com/t5/Splunk-Search/How-to-prevent-tstats-from-truncating-large-fields/m-p/585878#M204104 schplunk_meiste 2022-02-21T00:27:42Z