Splunk automatically breaking log entries after 100 lines.

tmail037 — Mon, 28 Sep 2020 11:53:49 GMT

I am trying out Splunk and facing an issue. I have some large log entries in my log file, say 250 lines and I have defined 'BREAK_ONLY_BEFORE = some regex'. Now in addition to breaking before the given regex, Splunk also breaks the log entry after every 100 lines. This resulting in multiple events (in above case 3 events) for single log entry. I have tried this using Splunk web's 'Data Preview' feature.

My props.conf setting for the sourcetype



[dummy_source]

BREAK_ONLY_BEFORE=^\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}\s---\sERROR:\s

NO_BINARY_CHECK=1

SHOULD_LINEMERGE=true

Please help.

Edit- I tried setting



MAX_EVENTS = 1000

Now I am getting single event for each log entry but the problem now is, the event displayed is truncated. It does not seem to contain all the 250 lines from the log entry.

Re: Splunk automatically breaking log entries after 100 lines.

tmail037 — Sat, 02 Jun 2012 10:43:10 GMT

I am updating this so that someday someone will benefit from it.

Its just the data preview UI which shows truncated logs. Actually the logs are not
truncated. Each event contains complete log entry.

topic Splunk automatically breaking log entries after 100 lines. in Getting Data In

Splunk automatically breaking log entries after 100 lines.

Re: Splunk automatically breaking log entries after 100 lines.