topic LineBreakingProcessor - Truncating line because limit of 10000 has been exceeded -Audit.log in Getting Data In

LineBreakingProcessor - Truncating line because limit of 10000 has been exceeded -Audit.log

jravida — Wed, 30 Apr 2014 19:21:42 GMT

Hi folks,

I am encountering this error in the splunkd.log. I've looked on how to increase the truncating limit, but am hesitant to apply it here because it is referencing "/opt/splunk/var/log/splunk/audit.log", which is an internal source as I see it. Where would I change the props.conf's TRUNCATE value and have it only apply to this file?

Re: LineBreakingProcessor - Truncating line because limit of 10000 has been exceeded -Audit.log

mcmaster — Wed, 30 Apr 2014 20:00:26 GMT

You should be able to add an entry to $SPLUNK_HOME/etc/system/local/props.conf similiar to this:

[source::.../var/log/splunk/audit.log(.\d+)?]
TRUNCATE = 0

which would disable truncation for that log file. This overrides the default TRUNCATE value for this source.

Before:

$SPLUNK_HOME/bin/splunk cmd btool props list 'source::.../var/log/splunk/audit.log' | grep TRUNCATE
TRUNCATE = 10000

After:

$SPLUNK_HOME/bin/splunk cmd btool props list 'source::.../var/log/splunk/audit.log' | grep TRUNCATE
TRUNCATE = 0

Re: LineBreakingProcessor - Truncating line because limit of 10000 has been exceeded -Audit.log

jravida — Wed, 30 Apr 2014 21:31:20 GMT

This did the trick. Thanks for the btool query to verify!

Re: LineBreakingProcessor - Truncating line because limit of 10000 has been exceeded -Audit.log

sw5269 — Mon, 28 Sep 2020 18:53:21 GMT

I am having same issue.
It is in a specific class and we have added the TRUNCATE in the $SPLUNK_HOME/etc/deployment_apps//local/props.conf, deployed it and verified it was at destination but still getting thousands of these messages.

Re: LineBreakingProcessor - Truncating line because limit of 10000 has been exceeded -Audit.log

AppServices — Thu, 16 Jun 2016 18:41:21 GMT

See http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings

This is a great site that shows which servers should contain the correct Splunk configuration files.

In your case, you are settings TRUNCATE (parsing phase) in your props.conf and sending it to your Splunk forwarder server. Based on the above link the only time you should set parsing on a forwarder is when it's a heavy forwarder. Otherwise, you should set your parsing configuration on your indexer.

So, trying adding your TRUNCATE setting in your props.conf on your indexer server and see if that resolves your issue.