So I figured out that my Splunk instance is truncating my JSON data. That's not good and I'd like to remedy this. In reading, it looks as though I need to override my props.conf file by using the local/props.conf file. Since I'm using a Universal Forwarder it appears I don't need touch this ( http://wiki.splunk.com/Community:HowIndexingWorks ) as from the picture TRUNCATE happens in the parsing stage on the main server.
Well it didn't work! Can someone with a bigger brain please point out my error? On the forwarder side I'm am monitoring the following file. FWIW - I also tried editing the UF side props.conf and that didn't work either.