I receive errors like the ones below:
LineBreakingProcessor - Truncating line because limit of 132000 bytes has been exceeded with a line length >= 136321
I solved this before by just raising the TRUNCATE value. Still i get these errors. Is there a point where I should stop raising this value? Are there risks in setting this value to high?
Thanks, kind regards,
the only risk will be to set it to
TRUNCATE = 0 !
Everything else will help Splunk in knowing instead of guessing where to truncate and therefore it will increase the parsing performance of the Splunk instance.
Hope this helps ...
Seriously if you have to set this value, you are best to either @#$@#$#$% or point your devs to this http://dev.splunk.com/view/logging/SP-CAAAFCK
Or use black magic or cough cribl cough to make the events useable 😉