Archive
Highlighted

LineBreakingProcessor question

Path Finder

Hello,

I receive errors like the ones below:
LineBreakingProcessor - Truncating line because limit of 132000 bytes has been exceeded with a line length >= 136321

I solved this before by just raising the TRUNCATE value. Still i get these errors. Is there a point where I should stop raising this value? Are there risks in setting this value to high?

Thanks, kind regards,
Willem

0 Karma
Highlighted

Re: LineBreakingProcessor question

SplunkTrust
SplunkTrust

Hi willemjongeneel,

the only risk will be to set it to TRUNCATE = 0 !
Everything else will help Splunk in knowing instead of guessing where to truncate and therefore it will increase the parsing performance of the Splunk instance.

Hope this helps ...

cheers, MuS

View solution in original post

0 Karma
Highlighted

Re: LineBreakingProcessor question

Path Finder

Yes that helps, thanks!

Kind regards,
Willem

0 Karma
Highlighted

Re: LineBreakingProcessor question

SplunkTrust
SplunkTrust

Ideally you want to limit it TRUNCATE = 999999 to allow genuinely long lines instead of setting to 0 (never truncate).

0 Karma
Highlighted

Re: LineBreakingProcessor question

SplunkTrust
SplunkTrust

Seriously if you have to set this value, you are best to either @#$@#$#$% or point your devs to this http://dev.splunk.com/view/logging/SP-CAAAFCK

Or use black magic or cough cribl cough to make the events useable 😉

cheers, MuS

0 Karma