TRUCANTE Logs

andgarciaa — Tue, 11 Jun 2024 08:11:58 GMT

Hello,

I am using Splunk Cloud, for some our sourcetypes we have defined specific TRUNCATE values. I have a couple of questions.

If `TRUNCATE` value is not defined for a sourcetype, what is the default limit of chars?

Is there any guideline document or rules on how to define TRUNCATE? Especially if it is recommended to set something higher than 50k or 80k chars as a limit.

Re: TRUCANTE Logs

gcusello — Tue, 11 Jun 2024 13:29:37 GMT

Hi @andgarciaa ,

you can find more infos at https://docs.splunk.com/Documentation/Splunk/9.2.1/Admin/Propsconf

and answering to your question:

TRUNCATE = <non-negative integer> * The default maximum line length, in bytes. * Although this is in bytes, line length is rounded down when this would otherwise land mid-character for multi-byte characters. * Set to 0 if you never want truncation (very long lines are, however, often a sign of garbage data). * Default: 10000

There isn't a general guideline: usually the TRUNCATE value is defined by the specific Add-On you're using and it's related to the technology you're using.

If you are ingesting a custom log, you have to choose the correct one by yourself.

Ciao.

Giuseppe

topic Re: TRUCANTE Logs in Splunk Search

TRUCANTE Logs

Re: TRUCANTE Logs