All Apps and Add-ons

Kafka modular input message is trimmed if message is longer, where can I change that ?

kraveruk
Explorer

Hey

I am pulling data from kafka topic, and some larger message jsons are being cut after X characters.

Because of that json format is incomplete and splunk does not recognise event as json type.

Can you please let me know where can I change message/event size >

Thanks

1 Solution

Damien_Dallimor
Ultra Champion

In props.conf for your sourcetype , update the TRUNCATE value.

http://docs.splunk.com/Documentation/Splunk/6.2.3/Admin/Propsconf

View solution in original post

Damien_Dallimor
Ultra Champion

In props.conf for your sourcetype , update the TRUNCATE value.

http://docs.splunk.com/Documentation/Splunk/6.2.3/Admin/Propsconf

tmagdanski
Engager

Fantastic, worked like a charm !

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...