Deployment Architecture

disable indexing LineBreakingProcessor warnings in _internal index

dgililo
New Member

Hi,
We have a problem with parsing logic which generates hundreds of thousands of truncate warnings every hour:
06-21-2014 18:14:34.121 -0700 WARN LineBreakingProcessor - Truncating line because limit of 800 has been exceeded with a line length >= 6985 - data_source="/

this issue causes Indexers to choke and eventually create indexing lag.

can someone clarify how to disable indexing of LineBreakingProcessor Warnings in _internal index?

i have tried updating /app/share/splunk/etc/log.cfg category.TailingProcessor=INFO to ERROR but it didnt work.
thanks,

Tags (1)
0 Karma

lguinn2
Legend

You could explicitly tell Splunk to truncate the line, and then Splunk wouldn't warn you that it did...

Put the following in props.conf

[source::/path/to/the/datasource]
# set the following to the maximum line length that you want
TRUNCATE = 800

Also, the TailingProcessor does not do line-breaking, so you might as well set that back to INFO. If you want to change the setting for the LineBreakingProcessor, edit the file named log-debug.cfg. You will need to uncomment the line.

Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...