Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: Do I need to create a transforms.conf file in ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Do I need to create a transforms.conf file in addition to props.conf to disable truncate for a specific sourcetype?
I have created a props.conf file to allow for logging an event of 16,000 characters. If I am reading the documentation correctly I can tie it to a specific source type and add it to the application I have deployed.
So, I added this props file to my app:
Increase the default line length
sourcetype = bluestripe
TRUNCATE = 0
But the line break is still happening. Do, I need to create a transforms.conf file to go with this that has a stanza name that I replicate in the props file for it to work? Or am I doing something else wrong?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
hello,
their are two settings in props.conf one for truncation and event breaking. TRUNCATE applies to maximum line length of a line in bytes and the other is MAX_EVENTS which specifies the maximum number of input lines to add to any event. If you event is over 16,000 chars long and multi line you will have to set both. By default MAX_EVENTS breaks an event after 256.
Modifying these setting may cause performance issues.
[bluestripe]
TRUNCATE = 0
MAX_EVENTS = 1000
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can you post the proper snippet of your props.conf file
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It Should be like this in props.conf
[bluestripe]
TRUNCATE = 0
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
transforms.conf is not needed
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
No transforms.conf needed?
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions
Splunk Community Badges!
[Puzzles] Solve, Learn, Repeat: Matching cron expressions
