Splunk Search

How to prevent tstats from truncating large fields

rhobby
New Member

I have an accelerated data model with a field with large strings in it.
When I use the spl

| data model dm_name ds_name search | table *

I can see the whole fields.

When I use tstats:

| tstats latest (_time) as _time latest (ds_name. data) as data from datamodel=dm_name.ds_name
where (nodename = ds_name)
groupby ds_name. id prestats=true

the data fields are truncated.

I tried to change [stats] maxvaluesize in limits.conf without success. There seems to be no such config for tstats.

How can I prevent tstats from truncating large fields?

Labels (1)
0 Karma

schplunk_meiste
Engager

"Accelerated fields have a limitation of 1024 bytes per entry, so you cannot use fields that have more than 1024 bytes"

https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/kvstore/usingconfigurationfiles/

0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...