| rest /services/authentication/users splunk_server=* | fields title, realname, splunk_server, last_successful_login | fillnull value=0 | eval days = now()-last_successful_login | where days < 2592000 | table title, realname, splunk_server, last_successful_login | convert ctime(last_successful_login) ... View more

Thats great news, I have converted my comment to an answer, Please accept it and ^ upvote it if you found it useful so that others in the community can see that it helepd. ... View more

LineBreaking is done as part of parsing pipeline: http://docs.splunk.com/Documentation/Splunk/7.2.1/Indexer/Howindexingworks#Event_processing_and_the_data_pipeline More details about event processing pipelines: https://wiki.splunk.com/Community:HowIndexingWorks Please note sometime parsing can be done by the Heavy Forwarder: http://docs.splunk.com/Documentation/Splunk/7.2.1/Deploy/Componentsofadistributedenvironment#How_components_support_the_data_pipeline If by any chance you have HF doing the parsing, perhaps you should apply relevant props.conf on the Heavy Forwarder. You may check splunkd.log on relevant Splunk components searching for "truncating" and look for if the particular log is getting truncated due to any setting. ... View more