I've been working on some sample logs with the Web UI to adjust timestamps and where the events break, so I can create a clean props.conf before putting the logs in splunk. The data logs have quite a bit of data per event, but we went ahead and made changes with the TRUNCATE = 0 and MAX_EVENTS = 10000 to account for this. With these in place, the preview window still cuts off data in the events. The only reason I can think of is that the preview area has a limit on the amount of data that can be previewed. Does anyone happen to know if there is a data limit in the web ui preview window? I can't think of any other reason why our data is being cut off. Thanks!
... View more