Getting Data In

Breaking event because limit of 256 has been exceeded

Nishant_07
New Member

04-06-2017 12:17:13.106 +0000 WARN AggregatorMiningProcessor - Changing breaking behavior for event stream because MAX_EVENTS (256) was exceeded without a single event break. Will set BREAK_ONLY_BEFORE_DATE to False, and unset any MUST_NOT_BREAK_BEFORE or MUST_NOT_BREAK_AFTER rules. Typically this will amount to treating this data as single-line only. - data_source="http-stream", data_host="104.45.139.239", data_sourcetype="log:websitewadlog"
component = AggregatorMiningProcessor index = _internal log_level = WARN source = /opt/splunk/var/log/splunk/splunkd.log sourcetype = splunkd splunk_server = SplunkIndexer1
4/6/17
12:17:13.106 PM
04-06-2017 12:17:13.106 +0000 WARN AggregatorMiningProcessor - Breaking event because limit of 256 has been exceeded - data_source="http-stream", data_host="104.45.139.239", data_sourcetype="log:websitewadlog"

I have already updated the source type with truncate = 0 and max_events =1000 still i am facing the issue can any one help.

What else i could do to resolve this issue.

Thank,
Nishant kumar

0 Karma

ColinCH
Path Finder

Hi,

Can you be sure that splunk can extract an Timestamp from the Event? If there is no Timestamp extracted by splunk the line breaking works not properly.

You can verify your configuration with "splunk btool --app=your-app-where-you-configured-the-props-conf props list"

Regards,
C

0 Karma
Get Updates on the Splunk Community!

Monitoring MariaDB and MySQL

In a previous post, we explored monitoring PostgreSQL and general best practices around which metrics to ...

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...