Getting Data In

Numerous messages WARN LineBreakingProcessor Truncating for remote_searches.log

babcolee
Path Finder

I am seeing numerous WARN messages in the splunkd.log "09-08-2016 13:56:07.802 +0000 WARN LineBreakingProcessor - Truncating line because limit of 10000 bytes has been exceeded with a line length >= 14298 - data_source="/opt/splunk/var/log/splunk/remote_searches.log", data_host="splunkidev01.dept.companyname.com", data_sourcetype="splunkd_remote_searches"
I added the following configuration to the /opt/splunk/etc/system/local/props.conf file but I am still seeing the messages. Is there an other place where the TRUNCATE can be set to increased so this message will go away
[source::///opt/splunk/var/log/splunk/remote_searches.log]
TRUNCATE = 20000

1 Solution

dshpritz
SplunkTrust
SplunkTrust

The most likely cause is that you have accelerated data models enabled, which will cause some very long searches to be run. To solve this, you will need to adjust the truncate setting for that sourcetype on your indexers:

props.conf:

[splunkd_remote_searches]
TRUNCATE = 999999

yes, that's a large number, but in my experience it works just fine.

View solution in original post

dshpritz
SplunkTrust
SplunkTrust

The most likely cause is that you have accelerated data models enabled, which will cause some very long searches to be run. To solve this, you will need to adjust the truncate setting for that sourcetype on your indexers:

props.conf:

[splunkd_remote_searches]
TRUNCATE = 999999

yes, that's a large number, but in my experience it works just fine.

View solution in original post

salbro
Path Finder

I'm having the same issue. What is the impact of increasing the TRUNCATE value, if any?

0 Karma

dshpritz
SplunkTrust
SplunkTrust

in this case, the impact is that the events will be larger, and the errors will go away. Generally, adjusting that value will allow for larger events. If your linebreaker is wrong, and you allow jumbo events, the possibility exists that your indexers/HFs will become unhappy.

0 Karma

babcolee
Path Finder

That worked. Thank you

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!