Splunk Search

Splunk is breaking my events in to two events

aleem
SplunkTrust
SplunkTrust

Hi,
I have events with 360 lines of text.

My problem is that Splunk
1. writes the first 257 lines of the event
2. writes the next event that happends to have the same timestamp
3. finishes off the writing the remaining 104 lines of the first event as a new event

I am not sure if having 360 lines in an event causes a bottle neck or if I need to modify a file somewhere.

Hopefully, it is a simple config update 😉

Be the best version of you
Tags (2)
0 Karma

Ayn
Legend

The docs page for props.conf is your friend here. Specifically, the MAX_EVENTS default value is likely to cause the effect you're seeing:

MAX_EVENTS = <integer>
* Specifies the maximum number of input lines to add to any event.
* Splunk breaks after the specified number of lines are read.
* Defaults to 256 (lines).
0 Karma

aleem
SplunkTrust
SplunkTrust

Sounds great Ayn. I'll have a go at doing this and feedback 😉

Be the best version of you
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...