Raw json file getting truncated

[jimbolya]

Using splunk developer version. I've set TRUNCATE to 25000 and max_events to a large number as well, but the information keeps getting truncated in the event window. I'm basically trying to import large amounts of json data from a single file. I know I'm not the only one working with json data so I'm sure the fix is nice and easy.

[hardikJsheth · Accepted solution]

You can handle it via props configuration for your specific source type.
i.e I am using following stanza which is able to extract raw JSON file of > 8MB.

[cmxmap]
TRUNCATE = 0
KV_MODE = json
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false

[paulbannister]

Try setting the TRUNCATE to 0 to remove the limit, we also had an issue when bringing in large amounts of json data via a REST API which was resolved by setting the "response handler" to "JSONArrayHandler", which specifically handles large amounts of json data... although I am unsure if this relates purely to the REST API

[briancronrath]

Do you have an extraction_cutoff value set anywhere in your limits.conf files?