Getting Data In

Breaking event because limit of 256 has been exceeded

New Member

04-06-2017 12:17:13.106 +0000 WARN AggregatorMiningProcessor - Changing breaking behavior for event stream because MAX_EVENTS (256) was exceeded without a single event break. Will set BREAK_ONLY_BEFORE_DATE to False, and unset any MUST_NOT_BREAK_BEFORE or MUST_NOT_BREAK_AFTER rules. Typically this will amount to treating this data as single-line only. - data_source="http-stream", data_host="104.45.139.239", data_sourcetype="log:websitewadlog"
component = AggregatorMiningProcessor index = _internal log_level = WARN source = /opt/splunk/var/log/splunk/splunkd.log sourcetype = splunkd splunk_server = SplunkIndexer1
4/6/17
12:17:13.106 PM
04-06-2017 12:17:13.106 +0000 WARN AggregatorMiningProcessor - Breaking event because limit of 256 has been exceeded - data_source="http-stream", data_host="104.45.139.239", data_sourcetype="log:websitewadlog"

I have already updated the source type with truncate = 0 and max_events =1000 still i am facing the issue can any one help.

What else i could do to resolve this issue.

Thank,
Nishant kumar

0 Karma

Path Finder

Hi,

Can you be sure that splunk can extract an Timestamp from the Event? If there is no Timestamp extracted by splunk the line breaking works not properly.

You can verify your configuration with "splunk btool --app=your-app-where-you-configured-the-props-conf props list"

Regards,
C

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!