topic Re: Why is my JSON format log getting truncated to 26 lines? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Why-is-my-JSON-format-log-getting-truncated-to-26-lines/m-p/404387#M71807 <P>@ddrillic Isn't that something Splunk doesn't recomment?</P> Mon, 01 Oct 2018 18:51:55 GMT Vijeta 2018-10-01T18:51:55Z Why is my JSON format log getting truncated to 26 lines? https://community.splunk.com/t5/Getting-Data-In/Why-is-my-JSON-format-log-getting-truncated-to-26-lines/m-p/404384#M71804 <P>I have a log file which has JSON format lines in the middle. The log looks fine but the JSON lines are getting truncated to 26 lines out of around 200 lines.</P> <P>Is there a way I can extract the full log without any truncation?</P> Mon, 01 Oct 2018 17:06:07 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-my-JSON-format-log-getting-truncated-to-26-lines/m-p/404384#M71804 pmosca 2018-10-01T17:06:07Z Re: Why is my JSON format log getting truncated to 26 lines? https://community.splunk.com/t5/Getting-Data-In/Why-is-my-JSON-format-log-getting-truncated-to-26-lines/m-p/404385#M71805 <P>What is your MAX_EVENTS and TRUNCATE in props.conf for this sourcetype?</P> Mon, 01 Oct 2018 18:45:34 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-my-JSON-format-log-getting-truncated-to-26-lines/m-p/404385#M71805 Vijeta 2018-10-01T18:45:34Z Re: Why is my JSON format log getting truncated to 26 lines? https://community.splunk.com/t5/Getting-Data-In/Why-is-my-JSON-format-log-getting-truncated-to-26-lines/m-p/404386#M71806 <P><CODE>TRUNCATE = 0</CODE> will keep you free ; -)</P> Mon, 01 Oct 2018 18:49:47 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-my-JSON-format-log-getting-truncated-to-26-lines/m-p/404386#M71806 ddrillic 2018-10-01T18:49:47Z Re: Why is my JSON format log getting truncated to 26 lines? https://community.splunk.com/t5/Getting-Data-In/Why-is-my-JSON-format-log-getting-truncated-to-26-lines/m-p/404387#M71807 <P>@ddrillic Isn't that something Splunk doesn't recomment?</P> Mon, 01 Oct 2018 18:51:55 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-my-JSON-format-log-getting-truncated-to-26-lines/m-p/404387#M71807 Vijeta 2018-10-01T18:51:55Z Re: Why is my JSON format log getting truncated to 26 lines? https://community.splunk.com/t5/Getting-Data-In/Why-is-my-JSON-format-log-getting-truncated-to-26-lines/m-p/404388#M71808 <P>It really depends on your own best practice. If you can ensure that each event is of reasonable size than <CODE>TRUNCATE = 0</CODE> is good. I used it and it was just fine.</P> Mon, 01 Oct 2018 18:57:53 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-my-JSON-format-log-getting-truncated-to-26-lines/m-p/404388#M71808 ddrillic 2018-10-01T18:57:53Z