JSON is truncated as soon a timestamp is found

Getting Data In

I'm trying to read a json file generated by a ps1 script on Windows, but the UF keep truncating the json as soon it finds a valid timestamp. Removing the timestamp 'fixes' the problem, but I need the timestamps. I've a similar script running on unix machine and the issues is not appearing there. My props is the following:

[sourcetype_name]
TRUNCATE = 0
BREAK_ONLY_BEFORE_DATE = false
DATETIME_CONFIG = NONE
MAX_TIMESTAMP_LOOKAHEAD = 0
INDEXED_EXTRACTIONS = JSON

I'm starting to think that it's a bug on Windows UFs.

Get Updates on the Splunk Community!

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Introducing the 2026 - 2027 SplunkTrust cohort!

The goal of the SplunkTrust™ membership has historically been to acknowledge and recognize those who go above ...

Splunk Auto Ingestion Parallel Pipeline Scaling

Why this feature matters Many Splunk environments experience ingestion pressure long before the host is fully ...