Breaking event because limit of 256 has been exceeded

[Nishant_07]

04-06-2017 12:17:13.106 +0000 WARN AggregatorMiningProcessor - Changing breaking behavior for event stream because MAX_EVENTS (256) was exceeded without a single event break. Will set BREAK_ONLY_BEFORE_DATE to False, and unset any MUST_NOT_BREAK_BEFORE or MUST_NOT_BREAK_AFTER rules. Typically this will amount to treating this data as single-line only. - data_source="http-stream", data_host="104.45.139.239", data_sourcetype="log:websitewadlog"
component = AggregatorMiningProcessor index = _internal log_level = WARN source = /opt/splunk/var/log/splunk/splunkd.log sourcetype = splunkd splunk_server = SplunkIndexer1
4/6/17
12:17:13.106 PM
04-06-2017 12:17:13.106 +0000 WARN AggregatorMiningProcessor - Breaking event because limit of 256 has been exceeded - data_source="http-stream", data_host="104.45.139.239", data_sourcetype="log:websitewadlog"

I have already updated the source type with truncate = 0 and max_events =1000 still i am facing the issue can any one help.

What else i could do to resolve this issue.

Thank,
Nishant kumar

[ColinCH]

Hi,

Can you be sure that splunk can extract an Timestamp from the Event? If there is no Timestamp extracted by splunk the line breaking works not properly.

You can verify your configuration with "splunk btool --app=your-app-where-you-configured-the-props-conf props list"

Regards,
C