https://community.splunk.com/t5/Getting-Data-In/Why-are-logs-are-being-cut-off/m-p/480655#M82412 <P>Some of the logs ingested into our Splunk environment has missing line. I was told that this could be the result of a delay in completion of logs. Is there a way around this?</P> Wed, 08 Jan 2020 15:38:58 GMT lawrence_magpoc 2020-01-08T15:38:58Z https://community.splunk.com/t5/Getting-Data-In/Why-are-logs-are-being-cut-off/m-p/480655#M82412 <P>Some of the logs ingested into our Splunk environment has missing line. I was told that this could be the result of a delay in completion of logs. Is there a way around this?</P> Wed, 08 Jan 2020 15:38:58 GMT https://community.splunk.com/t5/Getting-Data-In/Why-are-logs-are-being-cut-off/m-p/480655#M82412 lawrence_magpoc 2020-01-08T15:38:58Z https://community.splunk.com/t5/Getting-Data-In/Why-are-logs-are-being-cut-off/m-p/480656#M82413 <P>More information, please. What type of file(s)? How are they being ingested? What are the inputs.conf settings?</P> Wed, 08 Jan 2020 15:47:48 GMT https://community.splunk.com/t5/Getting-Data-In/Why-are-logs-are-being-cut-off/m-p/480656#M82413 richgalloway 2020-01-08T15:47:48Z https://community.splunk.com/t5/Getting-Data-In/Why-are-logs-are-being-cut-off/m-p/480657#M82414 <P>Missing or Truncated? By default Splunk default maximum line length is 10000, in bytes.<BR /> If your event is more than the default value you can increase the TRUNCATE value in props.conf but never ever set it to 0. <BR /> Make sure that you set properly the props.conf of the sourcetype of that data.<BR /> - DATETIME_CONFIG<BR /> - TIME_PREFIX<BR /> - TIME_FORMAT<BR /> - MAX_TIMESTAMP_LOOKAHEAD<BR /> - TZ<BR /> - LINE_BREAKER<BR /> - SHOULD_LINEMERGE</P> <P>Check splunkd.log for messages such as "AggregatorMiningProcessor" to know more what's happening </P> Wed, 30 Sep 2020 03:36:39 GMT https://community.splunk.com/t5/Getting-Data-In/Why-are-logs-are-being-cut-off/m-p/480657#M82414 jarizeloyola 2020-09-30T03:36:39Z