The Student Room Group

ECS Splunk logs truncated with Splunk-format raw

I'm having an AWS ECS Cluster and have configured it with Splunk logging and Splunk-format: raw in task definition like below:

{
"log Configuration": {
"logDriver": "splunk",
"secretOptions": [
{
"valueFrom": "myarn",
"name": "splunk-token"
}
],
"options": {
"splunk-url": "my-splunk-url",
"Splunk-source": "my-Splunk-source",
"Splunk-format": "raw"
}
}
}
All my dashboards in Splunk are expecting this format. The message are getting truncated at 4kb. Changing the format to inline does not truncate the messages but using this new format would require alot of rework in the Splunk Dashboards.

Is there a way to get this to work with splunk-format: raw without having message getting truncated?

Quick Reply

Latest

Trending

Trending