Archive

setting maximum input/log entry size

tedder
Communicator

So I have the following in inputs.conf:

[udp://10005]
connection_host =
index = serverlogs
sourcetype = syslog
disabled = 1

The entries appear to be truncated; how do I increase the input length so I can get full stack traces, for instance? What's the default length?

Tags (1)
0 Karma
1 Solution

ziegfried
Influencer

You might want to take a look at the line-breaking/merging options in props conf. http://www.splunk.com/base/Documentation/latest/Admin/Propsconf

Especially TRUNCATE and MAX_EVENTS.


Update:

TRUNCATE is set to 10000 by default and MAX_EVENTS to 256. Probably MAX_EVENTS is the bottleneck in your case. You could try setting the following in $SPLUNK_HOME/etc/system/local/props.conf:

[syslog]
MAX_EVENTS=1000

Which would allow 1000 lines to be merged to a single event.

If you're using Splunk in LWF (lightweight forwarder) mode on the forwarder, then you have to configure this on the indexer, otherwise on the forwarder.

View solution in original post

0 Karma

ziegfried
Influencer

You might want to take a look at the line-breaking/merging options in props conf. http://www.splunk.com/base/Documentation/latest/Admin/Propsconf

Especially TRUNCATE and MAX_EVENTS.


Update:

TRUNCATE is set to 10000 by default and MAX_EVENTS to 256. Probably MAX_EVENTS is the bottleneck in your case. You could try setting the following in $SPLUNK_HOME/etc/system/local/props.conf:

[syslog]
MAX_EVENTS=1000

Which would allow 1000 lines to be merged to a single event.

If you're using Splunk in LWF (lightweight forwarder) mode on the forwarder, then you have to configure this on the indexer, otherwise on the forwarder.

View solution in original post

0 Karma

ziegfried
Influencer

Updated the answer...

0 Karma

tedder
Communicator

Thanks, Ziegfried. I'm seeing ~2000 characters, but [SYSLOG] isn't set to "TRUNCATE=2000". In fact, that one isn't set. Is 2000 a default? If I add "TRUNCATE=10000, will that do it? (and does this go on my forwarder or my indexers?)

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!