updated /opt/splunk/etc/system/local/props.conf and put "TRUNCATE = 52428800" under [_json] so local/props.conf looks like: [_json]
TRUNCATE = 52428800 and now TRUNCATE returns as follows: $ /opt/splunk/bin/splunk btool props list _json --debug | grep -i truncate
/opt/splunk/etc/system/local/props.conf TRUNCATE = 52428800
... View more