Getting Data In

How to configure Splunk to index a one line JSON file with 55,000 characters?

khhenderson
Path Finder

I have been trying to index a one line JSON file with 55,000 characters in a single line.
Splunk seems to cut it off around 17,000 characters.

My props.conf

AMANDA JSON FILES
[amanda]
INDEXED_EXTRACTIONS = json
KV_MODE = none
TRUNCATE = 0
SHOULD_LINEMERGE = true

andygerber
Path Finder
0 Karma

khhenderson
Path Finder

Changed my limits.conf file
[spath]

number of characters to read from an XML or JSON event when auto extracting

extraction_cutoff = 60000
I'll test and let you know.

0 Karma

khhenderson
Path Finder

I have tested changing the setting in the limits.conf file.
Not Luck.
Could it be the search can only show so many characters?

0 Karma

damianpadden
Observer

hi,
Did you get to the bottom of this. I am in the same situation.

Thanks

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...