I am sending sauce labs test results to splunk and they are in this format:     { "testsuite": { "@name": "'PR-1082 #1' - device: Samsung_Galaxy_Note_8_real_us - test report id: 217", "@tests": "6", "@failures": "1", "@skipped": "0", "@timestamp": "2020-08-06T20:48:40.510Z", "@time": "223.437", "@package": "com.example", "testcase": [ { "@name": "C120116_testStatusFilterExitButton", "@classname": "com.example.AlertsMockTest", "@time": "7.47", "failure": "NoMatchingActivityFoundException: Activity MainActivity not visible after 5000 milliseconds\r\nat com.example.MainActivityRobot.isPageShown(MainActivityRobot.kt:17)\r\nat com.example.robots.MainActivityRobot.isPageShown$default(MainActivityRobot.kt:36)\r\nat com.example.AlertsMockTest$C120116_testStatusFilterExitButton$1.invoke(AlertsMockTest.kt:57)\r\nat com.example.AlertsMockTest$C120116_testStatusFilterExitButton$1.invoke(AlertsMockTest.kt:19)\r\nat com.example.robots.MainActivityRobotKt.mainActivity(MainActivityRobot.kt:30)\r\nat com.example.AlertsMockTest.C120116_testStatusFilterExitButton(AlertsMockTest.kt:56)\r\nat java.lang.reflect.Method.invoke(Native Method)\r\nat org.junit.runners.ParentRunner.access$000(ParentRunner.java:58)\r\nat org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:268)\r\nat org.junit.runners.ParentRunner.run(ParentRunner.java:363)\r\nat org.junit.runner.JUnitCore.run(JUnitCore.java:137)\r\nat org.junit.runner.JUnitCore.run(JUnitCore.java:115)\r\nat androidx.test.internal.runner.TestExecutor.execute(TestExecutor.java:56)\r\nat androidx.test.runner.AndroidJUnitRunner.onStart(AndroidJUnitRunner.java:395)\r\nat android.app.Instrumentation$InstrumentationThread.run(Instrumentation.java:2156)" }, { "@name": "C119770_testAlertTitleIs25Chars", "@classname": "com.example.AlertsMockTest", "@time": "6.835" }, { "@name": "C120116_testAlertsStatusFilterButton", "@classname": "com.example.AlertsMockTest", "@time": "7.181" }, { "@name": "C120106_testBackButtonExitsAppOnRegistrationLogin", "@classname": "com.example.MainActivityTest", "@time": "4.879" }, { "@name": "C117932_testShareButtonOpensShareSheet", "@classname": "com.example.MainActivityTest", "@time": "4.583" }, { "@name": "C134741_testZeroDashboards", "@classname": "com.example.ZeroDataMockTest", "@time": "7.248" } ] } }       I am trying this SPL:     source="http:test-results" sourcetype="_json" "testsuite.@failures">0 | rename testsuite.testcase{}.failure as testcase_failure, testsuite.testcase{}.@name as testcase_name | eval testcase_name=if(isnotnull(testcase_failure), testcase_name, "fail") | table testsuite.@name, testsuite.@failures, testsuite.@timestamp, testcase_name, testcase_failure | sort -testsuite.@timestamp | fieldformat testcase_failure=substr(testcase_failure,0,300)       However I get a table that looks like this:   How can I get the testcase_name column to only show just "C120116_testStatusFilterExitButton" for the test with a failure? ... View more

I am sending data to my splunk instance like https://docs.splunk.com/Documentation/Splunk/8.0.4/Data/HECExamples says to: curl -k "https://mysplunkserver.example.com:8088/services/collector" \ -H "Authorization: Splunk CF179AE4-3C99-45F5-A7CC-3284AA91CF67" \ -d '{"sourcetype": "_json","event": {'....over 10,000 character json event' I get a success return {"text":"Success","code":0}   When query for the event and i do a character count on it, I see it always truncates my events to 10,000 characters. On my server, looking at ./etc/system/default/limits.conf It has inside: [http_input] # The max number of tokens reported by logging input metrics. max_number_of_tokens = 10000 # The interval (in seconds) of logging input metrics report. metrics_report_interval = 60 # The max request content length (800MB, to match HTTP server). max_content_length = 838860800 # The max number of ACK channels. max_number_of_ack_channel = 1000000 # The max number of acked requests pending query. max_number_of_acked_requests_pending_query = 10000000 # The max number of acked requests pending query per ACK channel. max_number_of_acked_requests_pending_query_per_ack_channel = 1000000 Seems like everything is ok there.   And in ./etc/system/local/limits.conf it has: [search] allow_batch_mode = 1 allow_inexact_metasearch = 0 always_include_indexedfield_lispy = 0 default_allow_queue = 1 disabled = 0 enable_conditional_expansion = 1 enable_cumulative_quota = 0 enable_datamodel_meval = 1 enable_history = 1 enable_memory_tracker = 0 force_saved_search_dispatch_as_user = 0 load_remote_bundles = 0 record_search_telemetry = 1 remote_timeline = 1 search_retry = 0 timeline_events_preview = 0 track_indextime_range = 1 track_matching_sourcetypes = 1 truncate_report = 0 unified_search = 0 use_bloomfilter = 1 use_metadata_elimination = 1 write_multifile_results_out = 1   Why is Splunk truncating my events to 10,000 characters that I am sending? If my JSON is less than 10,000 characters, I am able to see all the data and it JSON formatted when I do a splunk query. ... View more