However, when splunk ingests these fields, it is cutting off the last one (account_last_changed) in the _raw
Anybody know why?
Tried setting TRUNCATE=0 and TRUNCATE=500000 etc etc in the props.conf
Cannot for the life of me get that last field to show up in Splunk
I also thought that perhaps it was treating that last field like a new time_stamp ans was thus getting confused and cutting it off. However, I tried moving the field closer to the first time_timestamp in the actual script (got all six fields to output correctly to the screen) but Splunk was still cutting it off.
depending on how your sourcetype is defined, the events may be kept in a block, broken per line, broken on new timestamps etc... Also if you are using. "INDEXED_EXTRACTIONS" on the forwarder, the events ma be parsed on the forwarder, not on the indexers (you need to customize the props.conf on the forwarder then)
if you want to create a working sourcetype props.conf, I would recommend to pick your sample of data, and try to ingest it on a SH, in the UI, using the editor to improve the parsing. At the end, copy past the props.conf, and deploy it on the indexers (or forwarder if you use special parsing on the forwarder)