All Apps and Add-ons

Why are ECS Splunk logs truncated with splunk-format raw?

New Member

I'm having an AWS ECS Cluster and have configured it with Splunk logging and splunk-format: raw in task definition like below:


"logConfiguration": {
"logDriver": "splunk",
"secretOptions": [
"valueFrom": "myarn",
"name": "splunk-token"
"options": {
"splunk-url": "my-splunk-url",
"splunk-source": "my-splunk-source",
"splunk-format": "raw"


All my dashboards in Splunk are expecting this format. The message are getting truncated at 4kb. Changing the format to inline does not truncate the messages but using this new format would require a lot of rework in the Splunk Dashboards.

Is there a way to get this to work with splunk-format: raw without having message getting truncated?

Labels (1)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...