In splunk dashboards we want to extract fields from _raw field, we achieved it by extract pairdelim="{,}" kvdelim=":" command and displayed the fields using table command.
Now we see events with more than 50k characters are skipped in the dashboard. Such events are spitted into 3 or more rows in the splunk logs view.
How to handle such events in the dashboard ? if _raw field can be truncated then which field should be referred for the original message.
