Splunk App for Stream: Why does the Splunk Web UI layout break when I search events that have the src_content and dest_content fields?

[kwchang_splunk]

Hello Stream experts,

I have a few questions about src_content and dest_content fields.

Q1. Sometimes, Splunk Web UI layout is broken when I searched the stream events which have the src_content or dest_content field.
Does this happen because of non-printable characters in the fields?

Q2. How are the src_content or dest_content fields encoded? Not encoded?

Q3. I tried to truncate the content fields with MaxFieldSize tag in streamfwd.xml. BTW the size of those content fields were not exactly matched with the size that I configured. When it was set to default value, the actual lengths were 11175, 11178... and when I reduced it to 1024, the actual lengths were 1442, 1025, 1392... as you can see below screenshot.

[vshcherbakov_sp]

Does this happen because of non-printable characters in the fields?

Is splunk able to detect/parse any fields in these events at all, or is the whole event is just a raw text blob?

Q2. How are the src_content or dest_content fields encoded? Not encoded?

These fields are JSON-encoded as per RFC 4627

Q3: the size of those content fields were not exactly matched with the size that I configured

MaxFieldSize is actually designed to be approximate and rounded to a next "chunk" (usually a packet) of data for performance reasons. I'll create a ticket to round it down (not up), so that the actual value is always less than the MaxFieldSize. The main purpose of this parameter though it to cap the event size so that it's not an order of magnitude larger than specified, not to cut exactly NNN bytes of a large field.