topic Re: How to handle truncation error in Splunk SDK? in Splunk Dev https://community.splunk.com/t5/Splunk-Dev/How-to-handle-truncation-error-in-Splunk-SDK/m-p/377713#M6220 <P><A href="https://answers.splunk.com/answers/788306/cannot-solve-mvexpand-output-will-be-truncated-due.html#answer-787149">check this splunk answer, same problem is resolved</A></P> Sun, 08 Dec 2019 09:14:17 GMT to4kawa 2019-12-08T09:14:17Z How to handle truncation error in Splunk SDK? https://community.splunk.com/t5/Splunk-Dev/How-to-handle-truncation-error-in-Splunk-SDK/m-p/377711#M6218 <P>Hi Pals,</P> <P>Thank you for viewing my question.</P> <P>I am retrieving my data through C# and Splunk SDK. But while extracting the results, I am facing the below truncation issue: <BR /> <EM>"Command mvexpand output will be truncated at XXXXX results due to excessive memory usage.......... max_mem_usage_mb has been reached"</EM>. <BR /> I have added all the required filter before MVEXPAND but then too no luck, So below is my question:<BR /> 1. Currently, I am slicing the timestamp to minutes and extracting the results. But is there any finer way which Splunk recommend?<BR /> 2. Can the <STRONG>output of Splunk SDK</STRONG> be JSON? If yes, then doing so can have better results?</P> Tue, 29 Sep 2020 23:51:06 GMT https://community.splunk.com/t5/Splunk-Dev/How-to-handle-truncation-error-in-Splunk-SDK/m-p/377711#M6218 waghpra 2020-09-29T23:51:06Z Re: How to handle truncation error in Splunk SDK? https://community.splunk.com/t5/Splunk-Dev/How-to-handle-truncation-error-in-Splunk-SDK/m-p/377712#M6219 <P>@waghpra, you may check your /default/props.conf in your app.<BR /> Check - <A href="https://answers.splunk.com/answers/41648/linebreakingprocessor-truncating-line-because-limit-of-10000-has-been-exceeded.html">https://answers.splunk.com/answers/41648/linebreakingprocessor-truncating-line-because-limit-of-10000-has-been-exceeded.html</A></P> Fri, 06 Dec 2019 04:22:07 GMT https://community.splunk.com/t5/Splunk-Dev/How-to-handle-truncation-error-in-Splunk-SDK/m-p/377712#M6219 pbankar 2019-12-06T04:22:07Z Re: How to handle truncation error in Splunk SDK? https://community.splunk.com/t5/Splunk-Dev/How-to-handle-truncation-error-in-Splunk-SDK/m-p/377713#M6220 <P><A href="https://answers.splunk.com/answers/788306/cannot-solve-mvexpand-output-will-be-truncated-due.html#answer-787149">check this splunk answer, same problem is resolved</A></P> Sun, 08 Dec 2019 09:14:17 GMT https://community.splunk.com/t5/Splunk-Dev/How-to-handle-truncation-error-in-Splunk-SDK/m-p/377713#M6220 to4kawa 2019-12-08T09:14:17Z