Why are events ingested using the journald modular...

Getting Data In

I'm pulling in events from the journal of a number of Linux hosts using the journald modular input.

I'm seeing truncated events every so often and, when I look at the length of _raw, I see that it's always 4088 bytes.

The man page for journalctl (https://www.freedesktop.org/software/systemd/man/journalctl.html) says that when events are outputted using JSON format, that "Fields larger than 4096 bytes are encoded as null values. (This may be turned off by passing --all, but be aware that this may allocate overly long JSON objects.)"

I'm presuming that that's what happening with the truncated events that I'm seeing. Is anyone aware of a way around this? I can't see any configuration setting associated with the journald modular input that would let me enable the '--all' flag.

FWIW, I'm running Splunk Enterprise 9.0.2

Get Updates on the Splunk Community!

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Between hands-on technical sessions, keynote reveals, and diving into live architectures, .conf26 is packed ...

Join the Hackathon at .conf26 and build a No-Code AI agent

Join us for the AI Agent Buildathon, an in-person, three-hour hands-on Hackathon where you’ll use Splunk Agent ...