topic Re: Why is Splunk cutting off the data received with collect command? in Getting Data In

Why is Splunk cutting off the data received with collect command?

benhurbarbieri — Wed, 22 Aug 2018 17:29:32 GMT

Splunk is cutting some data that is received through collect made on a server.

I have already reviewed the props.conf and inputs.conf files.

Has anyone seen anything about this?

Thankful.

Re: Why is Splunk cutting off the data received with collect command?

horsefez — Wed, 22 Aug 2018 18:17:09 GMT

Hi @benhurbarbieri,

it's not so clear what you are talking about, but I guess you are talking about Event-Breaking.
Maybe data is coming in and the event isn't breaking at the timestamp you configured.
Stuff like that is pretty common.

To help you, you need to post some sample data and the corresponding stanza's in props/transforms.conf if there are any.

Re: Why is Splunk cutting off the data received with collect command?

pruthvikrishnap — Wed, 22 Aug 2018 22:22:02 GMT

Hi Ben,
Try adding the complete values to your search try mentioning the complete index, source-type etc.

| collect index=summary sourcetype=foo

Re-check if any regex is applied on any field.
Share few samples on what is missing, may be we can look into it.
Let me know if this helps.

Re: Why is Splunk cutting off the data received with collect command?

nadlurinadluri — Thu, 23 Aug 2018 17:56:02 GMT

Ideally collect command is used only for statistical data, and I dont exactly understand as on what data is missing once you use collect command!! Can you elaborate?