Why is my JSON format log getting truncated to 26 lines?

[pmosca]

I have a log file which has JSON format lines in the middle. The log looks fine but the JSON lines are getting truncated to 26 lines out of around 200 lines.

Is there a way I can extract the full log without any truncation?

[ddrillic]

TRUNCATE = 0 will keep you free ; -)

[Vijeta]

@ddrillic Isn't that something Splunk doesn't recomment?

[ddrillic]

It really depends on your own best practice. If you can ensure that each event is of reasonable size than TRUNCATE = 0 is good. I used it and it was just fine.

[Vijeta]

What is your MAX_EVENTS and TRUNCATE in props.conf for this sourcetype?