Do I need to create a transforms.conf file in addition to props.conf to disable truncate for a specific sourcetype?

[briandickinson]

I have created a props.conf file to allow for logging an event of 16,000 characters. If I am reading the documentation correctly I can tie it to a specific source type and add it to the application I have deployed.

So, I added this props file to my app:

Increase the default line length

sourcetype = bluestripe
TRUNCATE = 0

But the line break is still happening. Do, I need to create a transforms.conf file to go with this that has a stanza name that I replicate in the props file for it to work? Or am I doing something else wrong?

[bmacias84]

hello,

their are two settings in props.conf one for truncation and event breaking. TRUNCATE applies to maximum line length of a line in bytes and the other is MAX_EVENTS which specifies the maximum number of input lines to add to any event. If you event is over 16,000 chars long and multi line you will have to set both. By default MAX_EVENTS breaks an event after 256.

Modifying these setting may cause performance issues.

[bluestripe]

TRUNCATE = 0

MAX_EVENTS = 1000

[strive]

Can you post the proper snippet of your props.conf file

[strive]

It Should be like this in props.conf

[bluestripe]
TRUNCATE = 0

[strive]

transforms.conf is not needed

[briandickinson]

No transforms.conf needed?