topic Re: Splunk is not showing entire log entries in Getting Data In

Splunk is not showing entire log entries

lyonsm — Mon, 06 May 2013 17:01:08 GMT

We are experiencing an issue with Splunk not showing entire log entries. For example if we look at a log in splunk for 1pm and that log has 50 lines with an option to expand to 66 line and then we look at the same log in the log file itself the log file will show that particular entry as having 100 or more lines. Is there a way to fix this issue?

Re: Splunk is not showing entire log entries

Ayn — Mon, 06 May 2013 20:50:48 GMT

Are you sure you configured event breaking correctly, or might it be that Splunk is breaking events where you wouldn't expect it to?

Re: Splunk is not showing entire log entries

bmacias84 — Mon, 06 May 2013 22:22:57 GMT

Ok, Make sure you have your event breaking correct. I am guessing that your events are exceeding the 10000 bytes default limit for an event. In your props.conf create TRUNCATE settings or enter TRUNCATE = 0 if you ever want an event to be truncated under your sourcetype stanza. There can be performance implications when increasing TRUNCATE.

Hope this helps or gets you started. Dont forget to accept and vote up answers.

Cheers,