Why are fields are not extracting properly in ServiceNow add-on?

[sylim_splunk]

ServiceNow add-on events are not extracting some fields properly, of which length are more than 10,000 bytes.

Due to that problem my users are not getting recent updates on ServiceNow task and Indicents in their dashboards.
The data we have concerns now was ingested several month ago - there are many more data that don't have fields not extracted though.
A search indeed shows the fields and values in _raw data so indexing is not the cause here.

[sylim_splunk · Accepted solution]

Here's a suggestion : https://answers.splunk.com/answers/770012/service-now-add-on-in-splunk-is-not-extracting-all.html - this would work if you could reduce the size of raw events down to less than 10240.

If this doesn't help fix the situation you can try the below which actually fix the field extraction issue here.
in limits.conf

[kv]
maxchars = 50000 ( by default 10240)

The 50k has been picked up by going through some raw data that have the field extraction issue, calculated based on where the fields in question appear into the events.
The maxchars is the limit that Splunk stop the field extraction process. TRUNCATE=10000 is not an issue here as long as you have "SHOULD_LINEMERGE=true" or the indexed raw data is longer than "TRUNCATE" value for the source/sourcetype.