Problem when extracting large JSON events.

Available Languages

Updated:September 29, 2026
Document ID:SPLK046045

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Enterprise Splunk Cloud

Description

While trying to extract Large JSON events (around 34k-40k characters in length non-truncated) running into restricted limits which caused that the field extraction was not working properly. spath command was used with no results.

Investigation

The [kv] stanza in limits.conf file allows field extractions for large JSON events.

Resolution

Change the following attributes in limits.conf to extract large JSON values.
 

[spath]
extraction_cutoff = 100000[kv]
maxchars = 100000



extraction_cutoff note: it may result in a increase of search time for searches leveraging Auto KV or spath.
maxchars note: Should only be performed if there are no long-running spikes (80%+) of total instance memory consumption.

new standard is: extraction_cutoff=100,000 maxchars=100,000

The above changes is not applicable for the users that are on Victoria experience instead it could be resolved by setting kv_mode=json via the TA for the specific sourcetype, provided the data is fully in JSON format since this is independent of maxchars parameter. As kv_mode=json is a search time configuration this needs to be set globally by adding export=system to the metadata file for the props stanza. 

For example: Set the below in the app's metadata file
[props]
export=system 
 



Is there a limit on searchable characters in an event?
 

Revision History

Revision Publish Date Comments
1.0
29-Sep-2026
Initial Release

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products

Related Articles