Field string incorrectly showing post onboarding

[splunklearner]

Hi, F5 team is sending logs to our splunk syslog server as comma seperated values. Post onboarding we see some of field values (string values) are truncating. 

Example:

From F5:

Violation_details=xxxxxxxxxxxxx(say 50 words)

after on-boarding to Splunk:

Violation_details=xxxxx (truncating)

What might be the issue here?

Syslog server -- UF -- Indexer (our flow)

[PickleRick]

The most typical reason for truncation when using syslog is when you're sending events over UDP and you're hitting datagram size limit.

Do you receive syslog on your "syslog server" and write events to file(s) from which you pick them up with an UF? If so, check the contents of the intermediate file(s). If the events are truncated there, it's a problem on the syslog side. If the events are OK there but are truncated after ingesting with UF, it's on UF's (or indexer's) side.

If it's the syslog side, you can try to switch to TCP.

[gcusello]

Hi @splunklearner ,

I suppose that you're using the standard add-on from Splunkbase (https://splunkbase.splunk.com/app/2846), otherwise, use it.

Check if in the logs are truncated or divided in two events.

If truncated, check the TRUNCATE option for that sourcetype.

If divided, check if in the logs there's some date.

Ciao.

Giuseppe