So I have the following in inputs.conf:
index = serverlogs
sourcetype = syslog
disabled = 1
The entries appear to be truncated; how do I increase the input length so I can get full stack traces, for instance? What's the default length?
You might want to take a look at the line-breaking/merging options in props conf.
Especially TRUNCATE and MAX_EVENTS.
TRUNCATE is set to 10000 by default and MAX_EVENTS to 256. Probably MAX_EVENTS is the bottleneck in your case. You could try setting the following in $SPLUNK_HOME/etc/system/local/props.conf:
Which would allow 1000 lines to be merged to a single event.
If you're using Splunk in LWF (lightweight forwarder) mode on the forwarder, then you have to configure this on the indexer, otherwise on the forwarder.
View solution in original post
Updated the answer...
Thanks, Ziegfried. I'm seeing ~2000 characters, but [SYSLOG] isn't set to "TRUNCATE=2000". In fact, that one isn't set. Is 2000 a default? If I add "TRUNCATE=10000, will that do it? (and does this go on my forwarder or my indexers?)