Getting Data In

How to configure Splunk to index a one line JSON file with 55,000 characters?

khhenderson
Path Finder

I have been trying to index a one line JSON file with 55,000 characters in a single line.
Splunk seems to cut it off around 17,000 characters.

My props.conf

AMANDA JSON FILES
[amanda]
INDEXED_EXTRACTIONS = json
KV_MODE = none
TRUNCATE = 0
SHOULD_LINEMERGE = true

andygerber
Path Finder
0 Karma

khhenderson
Path Finder

Changed my limits.conf file
[spath]

number of characters to read from an XML or JSON event when auto extracting

extraction_cutoff = 60000
I'll test and let you know.

0 Karma

khhenderson
Path Finder

I have tested changing the setting in the limits.conf file.
Not Luck.
Could it be the search can only show so many characters?

0 Karma

damianpadden
Observer

hi,
Did you get to the bottom of this. I am in the same situation.

Thanks

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...