topic Re: Why am I getting the following error from the LineBreakingProcessor: "Truncating line because limit of 10000 bytes has been exceeded?" in Getting Data In

Why am I getting the following error from the LineBreakingProcessor: "Truncating line because limit of 10000 bytes has been exceeded?"

swaroopbr — Sun, 09 Dec 2018 18:20:35 GMT

Hi Team,

I am using Splunk 7.1.1 and i have been getting this error constantly

LineBreakingProcessor - Truncating line because limit of 10000 bytes has been exceeded

As per various Splunk answers, I tried TRUNCATE=0 & TRUNCATE=999999 as well, but none of them worked for me. I had made sure the setting are in the correct props.conf

Any suggestions how do i get rid of this error?

Re: Why am I getting the following error from the LineBreakingProcessor: "Truncating line because limit of 10000 bytes has been exceeded?"

dkeck — Sun, 09 Dec 2018 21:23:46 GMT

Did you restart splunkd after changing the props?
Maybe check spelling ?
Please post your conf

Re: Why am I getting the following error from the LineBreakingProcessor: "Truncating line because limit of 10000 bytes has been exceeded?"

prakash007 — Mon, 10 Dec 2018 00:22:49 GMT

Make sure you have this configs on your indexers...
http://docs.splunk.com/Documentation/Splunk/7.2.1/Admin/Propsconf#Line_breaking

Re: Why am I getting the following error from the LineBreakingProcessor: "Truncating line because limit of 10000 bytes has been exceeded?"

scheng_splunk — Mon, 10 Dec 2018 01:34:50 GMT

LineBreaking is done as part of parsing pipeline:
http://docs.splunk.com/Documentation/Splunk/7.2.1/Indexer/Howindexingworks#Event_processing_and_the_data_pipeline

More details about event processing pipelines:
https://wiki.splunk.com/Community:HowIndexingWorks

Please note sometime parsing can be done by the Heavy Forwarder:
http://docs.splunk.com/Documentation/Splunk/7.2.1/Deploy/Componentsofadistributedenvironment#How_components_support_the_data_pipeline

If by any chance you have HF doing the parsing, perhaps you should apply relevant props.conf on the Heavy Forwarder.

You may check splunkd.log on relevant Splunk components searching for "truncating" and look for if the particular log is getting truncated due to any setting.