Numerous messages WARN LineBreakingProcessor Truncating for remote_searches.log

[babcolee]

I am seeing numerous WARN messages in the splunkd.log "09-08-2016 13:56:07.802 +0000 WARN LineBreakingProcessor - Truncating line because limit of 10000 bytes has been exceeded with a line length >= 14298 - data_source="/opt/splunk/var/log/splunk/remote_searches.log", data_host="splunkidev01.dept.companyname.com", data_sourcetype="splunkd_remote_searches"
I added the following configuration to the /opt/splunk/etc/system/local/props.conf file but I am still seeing the messages. Is there an other place where the TRUNCATE can be set to increased so this message will go away
[source::///opt/splunk/var/log/splunk/remote_searches.log]
TRUNCATE = 20000

[dshpritz · Accepted solution]

The most likely cause is that you have accelerated data models enabled, which will cause some very long searches to be run. To solve this, you will need to adjust the truncate setting for that sourcetype on your indexers:

props.conf:

[splunkd_remote_searches]
TRUNCATE = 999999

yes, that's a large number, but in my experience it works just fine.

[salbro]

I'm having the same issue. What is the impact of increasing the TRUNCATE value, if any?

[dshpritz]

in this case, the impact is that the events will be larger, and the errors will go away. Generally, adjusting that value will allow for larger events. If your linebreaker is wrong, and you allow jumbo events, the possibility exists that your indexers/HFs will become unhappy.

[babcolee]

That worked. Thank you