topic Re: Prevent splunk from splitting file dump into 2 events? in Getting Data In

Prevent splunk from splitting file dump into 2 events?

msarro — Mon, 28 Sep 2020 14:20:49 GMT

Hello,
I have a universal forwarders installed on several servers. Each one is configured to monitor a license utilization file which is regenerated every day by a piece of 3rd party software. However, the file is being split into two events for some reason on only a few of our servers. The split always occurs at 257 lines.

Our props.conf file on our indexers reads like this:
[TRUNKING_AS_LICENSE_FILE]
MAX_TIMESTAMP_LOOKAHEAD = 40
TZ = UTC
MAX_EVENTS=10000

So what exactly would be causing the file to line break when I search with the search head? Is it a limit on the search head side of things to not show events longer than 256 lines? Any advice would be helpful.

Re: Prevent splunk from splitting file dump into 2 events?

lguinn2 — Mon, 15 Jul 2013 19:51:07 GMT

Splunk limits events to 10000 characters by default. So in addition to setting MAX_EVENTS, you may also want to set TRUNCATE

TRUNCATE = 0

means "never truncate" but you can also set a large integer value as well...

The Splunk indexer does not really care about silly human things like line breaks or lengths. 🙂 These settings are to keep things sane for us. I have seen events that were over 10K in size, and Splunk worked fine. However - it is not possible to see an event this large in the Splunk UI. Or at least, you can't view the entire event all at once. But it is there in Splunk...

Re: Prevent splunk from splitting file dump into 2 events?

msarro — Mon, 15 Jul 2013 21:13:17 GMT

I will give this a try and see if it resolves the problem tomorrow morning. Thank you for the feedback either way!

Re: Prevent splunk from splitting file dump into 2 events?

msarro — Tue, 16 Jul 2013 13:36:18 GMT

This worked exactly as I needed, thank you! I now have beautiful 281 line events, ha!