Multi-Line event truncated

damianshaw · ‎01-05-2011

Hi all,

I am demoing splunk to see if it's appropriate for the company I work for, one of the problems I have hit is one of the logs I would like it to index has 200+ line XML events. After successfully spending sometime working out how to get it to index the timestamp above the XML and not the timestamps in the XML I have now hit a problem with these events.

When the event hit approx 110 lines / 4026 characters it truncates at that point. Is there some workaround? I was looking at limits.conf but I can't find the right stanza / variable.

damianshaw · ‎01-06-2011

Turns out it was our own logs that did this, doh!!

Multi-Line event truncated

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Build a No-Code AI Agent at .conf26: Join the AI Agent Buildathon

Level Up Your Workflow: Mastering Splunk Cloud Management via Terraform

Forwarder Topology Guidance: Intermediate HF vs Intermediate UF

Join the Conversation

Multi-Line event truncated

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Build a No-Code AI Agent at .conf26: Join the AI Agent Buildathon

Level Up Your Workflow: Mastering Splunk Cloud Management via Terraform

Forwarder Topology Guidance: Intermediate HF vs Intermediate UF