Getting Data In

How to truncate events in SplunkWeb

mihenn
Path Finder

Hello,

I have an unusual requirement for Splunk. I have a source that returns error messages from Java applications. These applications process messages from a Kafka cluster. If an error occurs, the message from Kafka is sometimes appended to the error message. These messages are about 5MB in size.

I get the events in Splunk. However, the display of this data is a problem. If I search the corresponding index, I get back these very big events among other smaller ones. These cause SplunkWeb to stop responding.

Is it possible to truncate events in SplunkWeb. The events should be available in the index, but should not be visible in their full length in Splunk.

I have already tried ui-prefs. conf. This allows me to limit the display of events to a certain number of lines via display. events. maxLines. However, this only applies to the preview. The complete event is still included in the HTML code of the page.

Is there any way to limit this data earlier?

Thank you very much.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...