Getting Data In

How can we apply TRUNCATE across many sourcetypes?

Ultra Champion

We would like to set TRUNCATE=0 so we don't truncate the events at all. We normally use the sourcetype in props.conf. However, the customer has many sourcetypes. Can we use wildcard to specify the set sourcetypes or the indexes (which we have four)?

Maybe we can do it as a global setting for all apps?

Tags (2)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

The TRUNCATE is props.conf setting which applies to sourcetype or source or host (not index). For source and host, you can use wildcard as usual. The sourcetype doesn't allow wildcard as such but you can use a regex hack, as explained in below page, to use sort of wildcard.

https://www.splunk.com/blog/2014/07/31/quick-tip-wildcard-sourcetypes-in-props-conf.html

Again, it's a hack to it's officially not supported. For move caveats, read the 2nd (unaccepted) answer from below post.
https://answers.splunk.com/answers/8505/is-it-possible-to-use-wildcards-in-sourcetype-props-conf-sta...

View solution in original post

SplunkTrust
SplunkTrust

The TRUNCATE is props.conf setting which applies to sourcetype or source or host (not index). For source and host, you can use wildcard as usual. The sourcetype doesn't allow wildcard as such but you can use a regex hack, as explained in below page, to use sort of wildcard.

https://www.splunk.com/blog/2014/07/31/quick-tip-wildcard-sourcetypes-in-props-conf.html

Again, it's a hack to it's officially not supported. For move caveats, read the 2nd (unaccepted) answer from below post.
https://answers.splunk.com/answers/8505/is-it-possible-to-use-wildcards-in-sourcetype-props-conf-sta...

View solution in original post

Ultra Champion

Gorgeous @somesoni2 - can we simply do it across all data?

0 Karma

SplunkTrust
SplunkTrust

In props.conf, there is a [default] stanza. Adding TRUNCATE=0 there will apply that setting to all sourcetypes. You can override this setting at each sourcetype level too.

Ultra Champion

Perfect - I really don't see a reason to truncate anything.... much appreciated.

0 Karma