I'm very new to Splunk so forgive me if this isn't the best method available. I too was having this issue with limiting the length/size of Messages from Windows 2008 Security Logs. The work answer for me was to use the regex creation tool. Take a sample event and use the field extractor function. (Little drop down arrow in the top left corner.) This will open a new tab for Extract fields. In the sample events highlight the message that you are wanting to see and past this into the "Example values for a field:" Generate the regex then rename it as something more user friendly. Again this may be a beginner stuff but it worked for me! ... View more