https://community.splunk.com/t5/Getting-Data-In/Half-event-to-index-queue-and-half-event-to-null-queue/m-p/320047#M59773 <P>Hi,</P> <P>I have tried using Truncate in props.conf, but it did not help me out.</P> <P>The logs are from kafka topic events.</P> <P>Regards,<BR /> BK</P> Thu, 07 Sep 2017 08:50:49 GMT bharathkumarnec 2017-09-07T08:50:49Z https://community.splunk.com/t5/Getting-Data-In/Half-event-to-index-queue-and-half-event-to-null-queue/m-p/320045#M59771 <P>Hi All,</P> <P>Is there a possibility to send half of the event to index queue and half of the event to null queue??</P> <P>Can this be done based on the size of the event, for example only 1Kb event should be indexed out of 1MB event and rest should be sent to null queue.</P> <P>Thanks in advance for your inputs!</P> <P>Regards,<BR /> BK</P> Thu, 07 Sep 2017 07:44:23 GMT https://community.splunk.com/t5/Getting-Data-In/Half-event-to-index-queue-and-half-event-to-null-queue/m-p/320045#M59771 bharathkumarnec 2017-09-07T07:44:23Z https://community.splunk.com/t5/Getting-Data-In/Half-event-to-index-queue-and-half-event-to-null-queue/m-p/320046#M59772 <P>Hi bharathkumarnec,<BR /> you can use TRUNCATE in props.conf to limit the lenght of each event of a specified sourcetype.<BR /> Bye.<BR /> Giuseppe</P> Thu, 07 Sep 2017 08:08:57 GMT https://community.splunk.com/t5/Getting-Data-In/Half-event-to-index-queue-and-half-event-to-null-queue/m-p/320046#M59772 gcusello 2017-09-07T08:08:57Z https://community.splunk.com/t5/Getting-Data-In/Half-event-to-index-queue-and-half-event-to-null-queue/m-p/320047#M59773 <P>Hi,</P> <P>I have tried using Truncate in props.conf, but it did not help me out.</P> <P>The logs are from kafka topic events.</P> <P>Regards,<BR /> BK</P> Thu, 07 Sep 2017 08:50:49 GMT https://community.splunk.com/t5/Getting-Data-In/Half-event-to-index-queue-and-half-event-to-null-queue/m-p/320047#M59773 bharathkumarnec 2017-09-07T08:50:49Z https://community.splunk.com/t5/Getting-Data-In/Half-event-to-index-queue-and-half-event-to-null-queue/m-p/320048#M59774 <P>with TRUNCATE you define the max lenght of your events.<BR /> If you can define a point of your events (e.g. a word or some chars) that you can use in a regex you can delete all chars after this word or chars.<BR /> Bye.<BR /> Giuseppe</P> Thu, 07 Sep 2017 10:26:53 GMT https://community.splunk.com/t5/Getting-Data-In/Half-event-to-index-queue-and-half-event-to-null-queue/m-p/320048#M59774 gcusello 2017-09-07T10:26:53Z https://community.splunk.com/t5/Getting-Data-In/Half-event-to-index-queue-and-half-event-to-null-queue/m-p/320049#M59775 <P>My data is in JSON format, will regex take care of this for JSON events??</P> Fri, 08 Sep 2017 07:32:39 GMT https://community.splunk.com/t5/Getting-Data-In/Half-event-to-index-queue-and-half-event-to-null-queue/m-p/320049#M59775 bharathkumarnec 2017-09-08T07:32:39Z https://community.splunk.com/t5/Getting-Data-In/Half-event-to-index-queue-and-half-event-to-null-queue/m-p/320050#M59776 <P>with regex you can parse every event, can you share an example of your logs?<BR /> Bye.<BR /> Giuseppe</P> Fri, 08 Sep 2017 07:36:37 GMT https://community.splunk.com/t5/Getting-Data-In/Half-event-to-index-queue-and-half-event-to-null-queue/m-p/320050#M59776 gcusello 2017-09-08T07:36:37Z https://community.splunk.com/t5/Getting-Data-In/Half-event-to-index-queue-and-half-event-to-null-queue/m-p/320051#M59777 <P>You have 2 options:<BR /> 1: Have Splunk split it into 2 events and then throw away one of them. This is silly.<BR /> 2: Use <CODE>SEDCMD</CODE> to strip the bad part of the event and replace it with nothing. This rocks.</P> Sun, 10 Sep 2017 03:55:45 GMT https://community.splunk.com/t5/Getting-Data-In/Half-event-to-index-queue-and-half-event-to-null-queue/m-p/320051#M59777 woodcock 2017-09-10T03:55:45Z