All Apps and Add-ons

Why are ECS Splunk logs truncated with splunk-format raw?

atonalwilson
New Member

I'm having an AWS ECS Cluster and have configured it with Splunk logging and splunk-format: raw in task definition like below:

 

{
"logConfiguration": {
"logDriver": "splunk",
"secretOptions": [
{
"valueFrom": "myarn",
"name": "splunk-token"
}
],
"options": {
"splunk-url": "my-splunk-url",
"splunk-source": "my-splunk-source",
"splunk-format": "raw"
}
}
}

 

All my dashboards in Splunk are expecting this format. The message are getting truncated at 4kb. Changing the format to inline does not truncate the messages but using this new format would require a lot of rework in the Splunk Dashboards.

Is there a way to get this to work with splunk-format: raw without having message getting truncated?

Labels (1)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...