Getting Data In

Search result JSON all fields not being extracted

New Member

I have a JSON within my search results whose fields are not being extracted all.
More specifically, a single field within that JSON is much longer than others - 40k characters, other are all under 50 characters. When I try to query any field which is above the long one in specific JSON, I do get a result. However, if I query any fields which is below the long one, no results are returned. Example:
I can query by field1 and field2 but not long_field and field4. Also, when I add "| fields *" to the query, only field1 and field2 would be among "Interesting fields" select or the results table.

The JSON itself is roughly 30-35 KB in size.

What could be the possible reason for such behavior?

0 Karma



You might be hitting the max character limits.
The default is near to 10K characters.

Please update the limits.conf.
Do create a limits.conf in your app local directory otherwise it will update the entire Splunk environment
Path - /splunk_home/etc/apps/your_app/local/limits.conf

Please try and let us know the outcome,

 maxchars = <integer>
0 Karma

New Member

Setting it to 100.000 did not help (message is under 40.000 chars).

0 Karma


Set kv_mode=JSON on the sourcetype definition in props. Do not rely on kv_mode=AUTO

0 Karma

New Member

Tried, did not help.

0 Karma

Ultra Champion

How is spath result?

0 Karma

New Member

I'm not quite sure what is the question here?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...