Powershell Scripted input truncated in raw

[spluzer]

Hey Splunksters,

I have a scripted input (powershell) that outputs correctly 6 fields on the screen like this:

expiration_date          user       login                            cardRequired          location     account_last_changed
mm/dd/yy 15:03        joblo      some_stats              true/false                  blah             mm/dd/yy 16:06


However, when splunk ingests these fields, it is cutting off the last one (account_last_changed) in the _raw

Anybody know why? 

Tried setting TRUNCATE=0 and TRUNCATE=500000   etc etc in the props.conf

Cannot for the life of me get that last field to show up in Splunk

I also thought that perhaps it was treating that last field like a new time_stamp ans was thus getting confused and cutting it off.  However, I tried moving the field closer to the first time_timestamp in the actual script (got all six fields to output correctly to the screen) but Splunk was still cutting it off.

Any help is much appreciated!

Thanks!

[yannK]

depending on how your sourcetype is defined, the events may be kept in a block, broken per line, broken on new timestamps etc... Also if you are using. "INDEXED_EXTRACTIONS" on the forwarder, the events ma be parsed on the forwarder, not on the indexers (you need to customize the props.conf on the forwarder then)

if you want to create a working sourcetype props.conf, I would recommend to pick your sample of data, and try to ingest it on a SH, in the UI, using the editor to improve the parsing. At the end, copy past the props.conf, and deploy it on the indexers (or forwarder if you use special parsing on the forwarder)

https://docs.splunk.com/Documentation/Splunk/latest/Data/Setsourcetype