topic Re: logs not complete in Splunk Dev

logs not complete

jadengoho — Mon, 13 Aug 2018 04:06:21 GMT

Hi ,
I am having trouble right now on why does the splunk log is not complete/cut , in the past few months logs are coming consistently complete.
but now it is cut shows only the header and no information.

it came from a server that monitor the logs,
Can somebody tell me why this happens ?
what to investigate ?
Also what is the solution for this problem?

-thanks in advance

Re: logs not complete

brian_rampley — Mon, 13 Aug 2018 06:44:48 GMT

I would need to see your inputs.conf, props.conf, and transforms.conf for your particular input, but my first guess would be to investigate your settings in props.conf for your sourcetype.

Re: logs not complete

nadlurinadluri — Tue, 14 Aug 2018 22:51:44 GMT

Are the logs getting truncated by any chance?

Re: logs not complete

jadengoho — Tue, 14 Aug 2018 23:51:14 GMT

1) here is my configuratoin file :
Inputs: [monitor:///var/log/backup] disabled = 0 sourcetype = backup:mtx

there are no props and transforms set on the whole process.
Server(log)-universal forwarder > indexer > search head

2)Are the logs getting truncated by any chance?
- The logs are being cut off in that specific part,
there are chances that it would gave as a whole, but most of the time it is missing parts after the
"============Backup Summary============"
45% of the log it sent are being cut.
Still can't figure this out.

Re: logs not complete

nadlurinadluri — Fri, 17 Aug 2018 16:57:30 GMT

I was under the impression that the logs are getting truncated after 10,000 character limit. But clearly thats not the case. Did you get a chance to look at the splunkd logs and see if you have any errors highlighted?

Re: logs not complete

brian_rampley — Mon, 20 Aug 2018 15:07:07 GMT

Does your data contain timestamps? I don't see any in your sample logs above, but I'm curious is there are timestamps in the missing portions of the data.

Re: logs not complete

sudosplunk — Mon, 20 Aug 2018 18:06:06 GMT

Looks like the line breaking issue is because there are no settings defined in props.conf and the default settings are not working properly for your data. Can you provide sample events (at least 2) and tell me what the event boundaries are.

Re: logs not complete

jadengoho — Tue, 28 Aug 2018 01:13:35 GMT

Thanks all for the help, adding props.conf helps the data to be completed,
Still not sure on why does the logs have been cut, but thank's it's working now.