Getting Data In

How to edit props.conf to override Splunk truncating JSON data?


Hi Guys,

So I figured out that my Splunk instance is truncating my JSON data. That's not good and I'd like to remedy this. In reading, it looks as though I need to override my props.conf file by using the local/props.conf file. Since I'm using a Universal Forwarder it appears I don't need touch this ( ) as from the picture TRUNCATE happens in the parsing stage on the main server.

So on my main server I added the following stanza. I then read ( ) that I simply need to hit | extract reload=T and I should be in business.

Well it didn't work! Can someone with a bigger brain please point out my error? On the forwarder side I'm am monitoring the following file. FWIW - I also tried editing the UF side props.conf and that didn't work either.

/opt/splunk/splunkforwarder/bin/splunk add monitor /var/log/django/ -sourcetype json


pulldown_type = true
TRUNCATE = 30000
KV_MODE = none
category = Structured
description = JavaScript Object Notation format. For more information, visit

Finally here is the image of it getting truncated at 10000 which is the default.
alt text

0 Karma


From your screenshot I can see the sourctype is json, not _json as your per your props.conf. Have you tried changing the stanza name in props.conf?

0 Karma