Getting Data In

Breaking event because limit of 256 has been exceeded

New Member

04-06-2017 12:17:13.106 +0000 WARN AggregatorMiningProcessor - Changing breaking behavior for event stream because MAXEVENTS (256) was exceeded without a single event break. Will set BREAKONLYBEFOREDATE to False, and unset any MUSTNOTBREAKBEFORE or MUSTNOTBREAKAFTER rules. Typically this will amount to treating this data as single-line only. - datasource="http-stream", datahost="104.45.139.239", datasourcetype="log:websitewadlog"
component = AggregatorMiningProcessor index = _internal log
level = WARN source = /opt/splunk/var/log/splunk/splunkd.log sourcetype = splunkd splunkserver = SplunkIndexer1
4/6/17
12:17:13.106 PM
04-06-2017 12:17:13.106 +0000 WARN AggregatorMiningProcessor - Breaking event because limit of 256 has been exceeded - data
source="http-stream", datahost="104.45.139.239", datasourcetype="log:websitewadlog"

I have already updated the source type with truncate = 0 and max_events =1000 still i am facing the issue can any one help.

What else i could do to resolve this issue.

Thank,
Nishant kumar

0 Karma

Path Finder

Hi,

Can you be sure that splunk can extract an Timestamp from the Event? If there is no Timestamp extracted by splunk the line breaking works not properly.

You can verify your configuration with "splunk btool --app=your-app-where-you-configured-the-props-conf props list"

Regards,
C

0 Karma