topic Why is my JSON format log getting truncated? in Getting Data In

Why is my JSON format log getting truncated?

pdantuuri0411 — Wed, 12 Sep 2018 15:52:02 GMT

I have a log which has a JSON format line in the middle. Splunk is extracting the log but is truncating the JSON part to 26 lines. How do I get the full log without Splunk truncating the JSON lines?

Re: Why is my JSON format log getting truncated?

mstjohn_splunk — Wed, 12 Sep 2018 16:46:21 GMT

Hi @pdanturri0411,

Thanks for posting. Could you give us some more context for your query? You have a much better chance of getting your question answered if you provide more information about your issue. Plus, it will help guide future community users who are facing a similar problem.

Re: Why is my JSON format log getting truncated?

yarick — Wed, 12 Sep 2018 19:12:43 GMT

MAX_EVENTS = <integer> Specifies the maximum number of input lines that Splunk software adds to any event. The software breaks the event after it reads the specified number of lines. 256 lines

REF. https://docs.splunk.com/Documentation/Splunk/7.1.2/Data/Configureeventlinebreaking

Re: Why is my JSON format log getting truncated?

KailA — Wed, 12 Sep 2018 19:54:32 GMT

Splunk truncateS an event after 10 000 characters, if you want to add more characters to a single event, you should modify your sourcetype in props.conf and add TRUNCATE = <integer>
That should be enough.

KailA

Re: Why is my JSON format log getting truncated?

MuS — Wed, 12 Sep 2018 22:02:27 GMT

Hi pdantuuri0411,

without seeing a sample event, my guess is that Splunk sees one of the values in the JSON as an epoch timestamp. Have a read here http://docs.splunk.com/Documentation/Splunk/latest/Data/Configureeventlinebreaking and configure the line breaking according.

Hope this helps ...

cheers, MuS