Why is Splunk not displaying the full log entry?

vcorral — Tue, 12 Mar 2019 19:29:36 GMT

I am only receiving the first two lines of a log entry into Splunk:

Date: 2019/03/12 14:00:10
SOFTWARE Module: D:\SOFTWARE_Enterprise\Service6.exe Machine Name: TESTSERVER001T Database Name: ORA-TEST

When the full entry should be:
Date: 2019/03/12 14:00:10
SOFTWARE Module: D:\SOFTWARE_Enterprise\Service6.exe Machine Name: TESTSERVER001T Database Name: ORA-TEST
Product Version: Release X.XX.XX.XX Jul 20 2018 11:57:17
Source id: Device <7616>
Software Integration Service Unavailable

Other log entries from other indexes are displaying the full log entries until they reach the truncate size, and this one is shorter than those. Any thoughts on where I can look to fix this would be appreciated.

Regards,
Virgil

Re: Why is Splunk not displaying the full log entry?

vcorral — Tue, 29 Sep 2020 23:57:14 GMT

So I figured this out. my props.conf file did not have anything set for the "BREAK_ONLY_BEFORE = ".
I added "Date:" to the line and now it works.

topic Why is Splunk not displaying the full log entry? in Splunk Search

Why is Splunk not displaying the full log entry?

Re: Why is Splunk not displaying the full log entry?