https://community.splunk.com/t5/Getting-Data-In/How-to-truncate-events-in-SplunkWeb/m-p/359481#M65588 <P>Hello,</P> <P>I have an unusual requirement for Splunk. I have a source that returns error messages from Java applications. These applications process messages from a Kafka cluster. If an error occurs, the message from Kafka is sometimes appended to the error message. These messages are about 5MB in size.</P> <P>I get the events in Splunk. However, the display of this data is a problem. If I search the corresponding index, I get back these very big events among other smaller ones. These cause SplunkWeb to stop responding. </P> <P>Is it possible to truncate events in SplunkWeb. The events should be available in the index, but should not be visible in their full length in Splunk.</P> <P>I have already tried <STRONG>ui-prefs. conf</STRONG>. This allows me to limit the display of events to a certain number of lines via <STRONG>display. events. maxLines</STRONG>. However, this only applies to the preview. The complete event is still included in the HTML code of the page.</P> <P>Is there any way to limit this data earlier?</P> <P>Thank you very much.</P> Wed, 07 Feb 2018 09:37:10 GMT mihenn 2018-02-07T09:37:10Z https://community.splunk.com/t5/Getting-Data-In/How-to-truncate-events-in-SplunkWeb/m-p/359481#M65588 <P>Hello,</P> <P>I have an unusual requirement for Splunk. I have a source that returns error messages from Java applications. These applications process messages from a Kafka cluster. If an error occurs, the message from Kafka is sometimes appended to the error message. These messages are about 5MB in size.</P> <P>I get the events in Splunk. However, the display of this data is a problem. If I search the corresponding index, I get back these very big events among other smaller ones. These cause SplunkWeb to stop responding. </P> <P>Is it possible to truncate events in SplunkWeb. The events should be available in the index, but should not be visible in their full length in Splunk.</P> <P>I have already tried <STRONG>ui-prefs. conf</STRONG>. This allows me to limit the display of events to a certain number of lines via <STRONG>display. events. maxLines</STRONG>. However, this only applies to the preview. The complete event is still included in the HTML code of the page.</P> <P>Is there any way to limit this data earlier?</P> <P>Thank you very much.</P> Wed, 07 Feb 2018 09:37:10 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-truncate-events-in-SplunkWeb/m-p/359481#M65588 mihenn 2018-02-07T09:37:10Z