Getting Data In
Highlighted

Numerous messages WARN LineBreakingProcessor Truncating for remote_searches.log

Path Finder

I am seeing numerous WARN messages in the splunkd.log "09-08-2016 13:56:07.802 +0000 WARN LineBreakingProcessor - Truncating line because limit of 10000 bytes has been exceeded with a line length >= 14298 - datasource="/opt/splunk/var/log/splunk/remotesearches.log", datahost="splunkidev01.dept.companyname.com", datasourcetype="splunkdremotesearches"
I added the following configuration to the /opt/splunk/etc/system/local/props.conf file but I am still seeing the messages. Is there an other place where the TRUNCATE can be set to increased so this message will go away
[source::///opt/splunk/var/log/splunk/remote_searches.log]
TRUNCATE = 20000

Highlighted

Re: Numerous messages WARN LineBreakingProcessor Truncating for remote_searches.log

SplunkTrust
SplunkTrust

The most likely cause is that you have accelerated data models enabled, which will cause some very long searches to be run. To solve this, you will need to adjust the truncate setting for that sourcetype on your indexers:

props.conf:

[splunkd_remote_searches]
TRUNCATE = 999999

yes, that's a large number, but in my experience it works just fine.

View solution in original post

Highlighted

Re: Numerous messages WARN LineBreakingProcessor Truncating for remote_searches.log

Path Finder

That worked. Thank you

0 Karma
Highlighted

Re: Numerous messages WARN LineBreakingProcessor Truncating for remote_searches.log

Path Finder

I'm having the same issue. What is the impact of increasing the TRUNCATE value, if any?

0 Karma
Highlighted

Re: Numerous messages WARN LineBreakingProcessor Truncating for remote_searches.log

SplunkTrust
SplunkTrust

in this case, the impact is that the events will be larger, and the errors will go away. Generally, adjusting that value will allow for larger events. If your linebreaker is wrong, and you allow jumbo events, the possibility exists that your indexers/HFs will become unhappy.

0 Karma