All Apps and Add-ons

JMS Modular Input - Truncation of events greater than 10,000 chars

rturk
Builder

Greetings!

We have configured the JMS Modular Input to be a durable subscriber to a JMS queue and we're happily retrieving data :thumbs-up:

We are also doing this in a DEV/TEST environment. In this environment, (large) stack traces are sometimes in the JSON payloads which tips the event over 10,000 characters... at which point we see the event become truncated, which breaks the JSON structure and the use of spath :sad-face:

Is there any setting anywhere that would allow me to disable/negate this?

Regards,

RT.

1 Solution

Damien_Dallimor
Ultra Champion

You can set the TRUNCATE parameter in props.conf for your sourcetype to prevent truncation.

As described in this answer.

View solution in original post

Damien_Dallimor
Ultra Champion

You can set the TRUNCATE parameter in props.conf for your sourcetype to prevent truncation.

As described in this answer.

rturk
Builder

Thanks Damien - I think I was having a derr moment as I put the TRUNCATE statement in the inputs.conf... Mea culpa. Thanks again for your help.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...