https://community.splunk.com/t5/Getting-Data-In/Multi-Line-event-truncated/m-p/20673#M3022 <P>Turns out it was our own logs that did this, doh!!</P> Thu, 06 Jan 2011 21:43:12 GMT damianshaw 2011-01-06T21:43:12Z https://community.splunk.com/t5/Getting-Data-In/Multi-Line-event-truncated/m-p/20672#M3021 <P>Hi all,</P> <P>I am demoing splunk to see if it's appropriate for the company I work for, one of the problems I have hit is one of the logs I would like it to index has 200+ line XML events. After successfully spending sometime working out how to get it to index the timestamp above the XML and not the timestamps in the XML I have now hit a problem with these events. </P> <P>When the event hit approx 110 lines / 4026 characters it truncates at that point. Is there some workaround? I was looking at limits.conf but I can't find the right stanza / variable.</P> Wed, 05 Jan 2011 16:53:15 GMT https://community.splunk.com/t5/Getting-Data-In/Multi-Line-event-truncated/m-p/20672#M3021 damianshaw 2011-01-05T16:53:15Z https://community.splunk.com/t5/Getting-Data-In/Multi-Line-event-truncated/m-p/20673#M3022 <P>Turns out it was our own logs that did this, doh!!</P> Thu, 06 Jan 2011 21:43:12 GMT https://community.splunk.com/t5/Getting-Data-In/Multi-Line-event-truncated/m-p/20673#M3022 damianshaw 2011-01-06T21:43:12Z