https://community.splunk.com/t5/Getting-Data-In/Do-I-need-to-create-a-transforms-conf-file-in-addition-to-props/m-p/113720#M23796 <P>No transforms.conf needed?</P> Fri, 05 Sep 2014 19:24:39 GMT briandickinson 2014-09-05T19:24:39Z https://community.splunk.com/t5/Getting-Data-In/Do-I-need-to-create-a-transforms-conf-file-in-addition-to-props/m-p/113717#M23793 <P>I have created a props.conf file to allow for logging an event of 16,000 characters. If I am reading the documentation correctly I can tie it to a specific source type and add it to the application I have deployed.</P> <P>So, I added this props file to my app:</P> <H1>Increase the default line length</H1> <P>sourcetype = bluestripe<BR /> TRUNCATE = 0</P> <P>But the line break is still happening. Do, I need to create a transforms.conf file to go with this that has a stanza name that I replicate in the props file for it to work? Or am I doing something else wrong? </P> Fri, 05 Sep 2014 19:14:09 GMT https://community.splunk.com/t5/Getting-Data-In/Do-I-need-to-create-a-transforms-conf-file-in-addition-to-props/m-p/113717#M23793 briandickinson 2014-09-05T19:14:09Z https://community.splunk.com/t5/Getting-Data-In/Do-I-need-to-create-a-transforms-conf-file-in-addition-to-props/m-p/113718#M23794 <P>It Should be like this in props.conf</P> <PRE><CODE>[bluestripe] TRUNCATE = 0 </CODE></PRE> Fri, 05 Sep 2014 19:21:50 GMT https://community.splunk.com/t5/Getting-Data-In/Do-I-need-to-create-a-transforms-conf-file-in-addition-to-props/m-p/113718#M23794 strive 2014-09-05T19:21:50Z https://community.splunk.com/t5/Getting-Data-In/Do-I-need-to-create-a-transforms-conf-file-in-addition-to-props/m-p/113719#M23795 <P>Can you post the proper snippet of your props.conf file</P> Fri, 05 Sep 2014 19:22:14 GMT https://community.splunk.com/t5/Getting-Data-In/Do-I-need-to-create-a-transforms-conf-file-in-addition-to-props/m-p/113719#M23795 strive 2014-09-05T19:22:14Z https://community.splunk.com/t5/Getting-Data-In/Do-I-need-to-create-a-transforms-conf-file-in-addition-to-props/m-p/113720#M23796 <P>No transforms.conf needed?</P> Fri, 05 Sep 2014 19:24:39 GMT https://community.splunk.com/t5/Getting-Data-In/Do-I-need-to-create-a-transforms-conf-file-in-addition-to-props/m-p/113720#M23796 briandickinson 2014-09-05T19:24:39Z https://community.splunk.com/t5/Getting-Data-In/Do-I-need-to-create-a-transforms-conf-file-in-addition-to-props/m-p/113721#M23797 <P>hello,</P> <P>their are two settings in props.conf one for truncation and event breaking. TRUNCATE applies to maximum line length of a line in bytes and the other is MAX_EVENTS which specifies the maximum number of input lines to add to any event. If you event is over 16,000 chars long and multi line you will have to set both. By default MAX_EVENTS breaks an event after 256.</P> <P>Modifying these setting may cause performance issues.</P> <P><CODE></CODE><PRE><CODE><BR /> [bluestripe]<BR /> TRUNCATE = 0<BR /> MAX_EVENTS = 1000<BR /> </CODE></PRE></P> Mon, 28 Sep 2020 17:30:28 GMT https://community.splunk.com/t5/Getting-Data-In/Do-I-need-to-create-a-transforms-conf-file-in-addition-to-props/m-p/113721#M23797 bmacias84 2020-09-28T17:30:28Z https://community.splunk.com/t5/Getting-Data-In/Do-I-need-to-create-a-transforms-conf-file-in-addition-to-props/m-p/113722#M23798 <P>transforms.conf is not needed</P> Fri, 05 Sep 2014 19:31:41 GMT https://community.splunk.com/t5/Getting-Data-In/Do-I-need-to-create-a-transforms-conf-file-in-addition-to-props/m-p/113722#M23798 strive 2014-09-05T19:31:41Z