Is there a way to split up the results that are being sent to firehose? Because if you follow the documentation to send results from scheduled queries to firehose and then to Splunk, sometimes Splunk will complain because the line of data it receives is too long (> 10000 bytes) and it will truncate it then

you could have a lambda transformer that kicks out payloads that are too large, saving them somewhere else (s3?) or just drop them?

the truncation limit in splunk is configurable https://docs.splunk.com/Documentation/ITSI/4.17.0/Configure/props.conf#Line_breaking notably the

TRUNCATE

option