The property @yeahnah mentioned  is [spath] extraction_cutoff; Splunk 9.0's default is 5000, not 10000. This limit applies to both automatic extraction and search command spath. (In fact, the search UI auto-format/syntax highlight are even affected by string size.  That's a different issue.)  So, you will need to up the limits.  Just do not change defaults/limits.conf.  Edit $SPLUNK_HOME/etc/system/local/limits.conf (create one if it doesn't exist yet) to add the following: [spath] extraction_cutoff = 15000 (This should suffice for the string size you illustrated.  If there are even larger ones, adjust accordingly.) Then, restart. ... View more