I have an accelerated data model with a field with large strings in it.
When I use the spl
| data model dm_name ds_name search | table *
I can see the whole fields.
When I use tstats:
| tstats latest (_time) as _time latest (ds_name. data) as data from datamodel=dm_name.ds_name
where (nodename = ds_name)
groupby ds_name. id prestats=true
the data fields are truncated.
I tried to change [stats] maxvaluesize in limits.conf without success. There seems to be no such config for tstats.
How can I prevent tstats from truncating large fields?
"Accelerated fields have a limitation of 1024 bytes per entry, so you cannot use fields that have more than 1024 bytes"
https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/kvstore/usingconfigurationfiles/