json sourcetype

[amanteja]

We are logging json formatted data in our logfiles that are fed into splunk, While sending the data we use sourcetype=log4j.

Splunk is able to correctly infer the messages and shows them in the UI as json events that are clickable. However, some records despite being fully qualified json appear as text. These events show up in the UI as clear text and many Json messages are contained in that event. Why does this happen? How can we avoid this?

[amanteja · Accepted solution]

I figured that this was because the server was truncating the log event. I changed the truncate value in etc/system/local/props.conf and it solved the problem.

[chaker]

You may need to post an example of the event that extracts correctly, and the one that does not.