nadlurinadluri those links don't work but thanks for getting back again. Would adding it to /opt//splunk/etc/system/local/props.conf on the indexer suffice? Also if I change the default source to how it is now on the first line, would that be ok, just like below? bearing in mind [/var/log/lighthouse/*.json] is the path of the files being indexed in the lighthouse server. Sorry to be a pain ; I am relatively new to splunk. [/var/log/lighthouse/*.json] CHARSET = UTF-8 LINE_BREAKER_LOOKBEHIND = 100 LINE_BREAKER = TRUNCATE = 0 DATETIME_CONFIG = /etc/datetime.xml ADD_EXTRA_TIME_FIELDS = True ANNOTATE_PUNCT = True HEADER_MODE = MATCH_LIMIT = 100000 DEPTH_LIMIT = 1000 MAX_DAYS_HENCE=2 MAX_DAYS_AGO=2000 MAX_DIFF_SECS_AGO=3600 MAX_DIFF_SECS_HENCE=604800 MAX_TIMESTAMP_LOOKAHEAD = 128 SHOULD_LINEMERGE = true BREAK_ONLY_BEFORE = Path= BREAK_ONLY_BEFORE_DATE = True MAX_EVENTS = 6000000 MUST_BREAK_AFTER = MUST_NOT_BREAK_AFTER = MUST_NOT_BREAK_BEFORE = TRANSFORMS = SEGMENTATION = indexing SEGMENTATION-all = full SEGMENTATION-inner = inner SEGMENTATION-outer = outer SEGMENTATION-raw = none SEGMENTATION-standard = standard LEARN_SOURCETYPE = true LEARN_MODEL = true maxDist = 100 AUTO_KV_JSON = true detect_trailing_nulls = false sourcetype = priority = ... View more

Thanks nadlurinadluri and swong_splunk for your answers. Truncate=0 did the magic. On a different note, now that it works in my local box, I need to move it to live. I am not very conversant with Splunk. In my live environment, we use the indexer, deployment servers, forwarders and then the search heads. Earlier I created app for the index , which works on live but just does not index everything as I said before which you resolved on my local box. In live, I am confused about which server to put the customised props.conf or if I should add other files as I also see online some people use transforms.conf, indexes.conf etc. Not sure what to do here and how to specify the source of the file. Please help. This is the config that works in my local box [default] CHARSET = UTF-8 LINE_BREAKER_LOOKBEHIND = 100 LINE_BREAKER = TRUNCATE = 0 DATETIME_CONFIG = /etc/datetime.xml ADD_EXTRA_TIME_FIELDS = True ANNOTATE_PUNCT = True HEADER_MODE = MATCH_LIMIT = 100000 DEPTH_LIMIT = 1000 MAX_DAYS_HENCE=2 MAX_DAYS_AGO=2000 MAX_DIFF_SECS_AGO=3600 MAX_DIFF_SECS_HENCE=604800 MAX_TIMESTAMP_LOOKAHEAD = 128 SHOULD_LINEMERGE = true BREAK_ONLY_BEFORE = Path= BREAK_ONLY_BEFORE_DATE = True MAX_EVENTS = 6000000 MUST_BREAK_AFTER = MUST_NOT_BREAK_AFTER = MUST_NOT_BREAK_BEFORE = TRANSFORMS = SEGMENTATION          = indexing SEGMENTATION-all      = full SEGMENTATION-inner    = inner SEGMENTATION-outer    = outer SEGMENTATION-raw      = none SEGMENTATION-standard = standard LEARN_SOURCETYPE      = true LEARN_MODEL           = true maxDist = 100 AUTO_KV_JSON = true detect_trailing_nulls = false sourcetype = priority = ... View more