https://community.splunk.com/t5/Getting-Data-In/Safe-TRUNCATE-value-on-json-events/m-p/538679#M90261 <P>What would be a “safe” value for the TRUNCATE option in props.conf?</P><P>I have some pretty big json events coming via HEC hitting the _json sourcetype (INDEXED_EXTRACTIONS=json).</P> Thu, 04 Feb 2021 19:50:39 GMT andreibanaru 2021-02-04T19:50:39Z https://community.splunk.com/t5/Getting-Data-In/Safe-TRUNCATE-value-on-json-events/m-p/538679#M90261 <P>What would be a “safe” value for the TRUNCATE option in props.conf?</P><P>I have some pretty big json events coming via HEC hitting the _json sourcetype (INDEXED_EXTRACTIONS=json).</P> Thu, 04 Feb 2021 19:50:39 GMT https://community.splunk.com/t5/Getting-Data-In/Safe-TRUNCATE-value-on-json-events/m-p/538679#M90261 andreibanaru 2021-02-04T19:50:39Z https://community.splunk.com/t5/Getting-Data-In/Safe-TRUNCATE-value-on-json-events/m-p/538776#M90277 <P>"Safe" is a relative term.&nbsp; To avoid all event truncations, the "safe" setting is <FONT face="courier new,courier">TRUNCATE = 0</FONT>, but that runs the risk of multiple events that are not line-broken correctly being ingested as a single event without warning.</P><P>Another "safe" approach is to set TRUNCATE to a reasonable value based on the expected event size plus a margin for error (maybe 10%).&nbsp; If the logs indicate an event was truncated then investigate to see if the line-breaking settings should be changes or if the TRUNCATE setting should be increase.&nbsp; Adjust and repeat.</P> Fri, 05 Feb 2021 14:29:43 GMT https://community.splunk.com/t5/Getting-Data-In/Safe-TRUNCATE-value-on-json-events/m-p/538776#M90277 richgalloway 2021-02-05T14:29:43Z