ECS Splunk logs truncated with splunk-format raw

Atonal Wilson 0 Reputation points
2023-04-01T04:45:44.94+00:00

I'm having an AWS ECS Cluster and have configured it with Splunk logging and Splunk-format: raw in task definition like below:

{

  "logConfiguration": {

    "logDriver": "splunk",

    "secretOptions": [

      {

        "valueFrom": "myarn",

        "name": "splunk-token"

      }

    ],

    "options": {

      "splunk-url": "my-splunk-url",

      "splunk-source": "my-splunk-source",

      "splunk-format": "raw"

    }

  }

}

All my dashboards in Splunk are expecting this format. The message is getting truncated at 4kb. Changing the format to inline does not truncate the messages but using this new format would require a lot of rework in the Splunk Dashboards.

Is there a way to get this to work with Splunk format: raw without having the message getting truncated?

Microsoft Teams
Microsoft Teams
A Microsoft customizable chat-based workspace.
9,223 questions
0 comments No comments
{count} votes