I had been hitting the same problem: some events had xml that was longer than 5000 characters, and spath wasn't extracting all the fields I knew were in there.
Here's how to fix it:
Override the spath character limit in $splunk_home%/etc/system/local/limits.conf.
My exact edit was to add the below config section to /opt/splunk/etc/system/local/limits.conf (since it wasn't there be default in 4.3.3). I pulled this from /opt/splunk/etc/system/default/limit.conf:
[spath]
extraction_cutoff = 10000
I copied and pasted my answer from here: http://answers.splunk.com/answers/179968/parsing-very-long-json-lines.html. I hope that's ok. These two Splunk answers were the top 2 in Google searches for, so I figured I'd contribute my solution in case it helps others.
In Fact it is because of the limitation of spath from 5000 characters, I have 10000...
for me it is really a problem don't being able to overwrite this setting as user... like "spath limit=10000"