Hello,
I have a universal forwarders installed on several servers. Each one is configured to monitor a license utilization file which is regenerated every day by a piece of 3rd party software. However, the file is being split into two events for some reason on only a few of our servers. The split always occurs at 257 lines.
Our props.conf file on our indexers reads like this:
[TRUNKING_AS_LICENSE_FILE]
MAX_TIMESTAMP_LOOKAHEAD = 40
TZ = UTC
MAX_EVENTS=10000
So what exactly would be causing the file to line break when I search with the search head? Is it a limit on the search head side of things to not show events longer than 256 lines? Any advice would be helpful.
Splunk limits events to 10000 characters by default. So in addition to setting MAX_EVENTS
, you may also want to set TRUNCATE
TRUNCATE = 0
means "never truncate" but you can also set a large integer value as well...
The Splunk indexer does not really care about silly human things like line breaks or lengths. 🙂 These settings are to keep things sane for us. I have seen events that were over 10K in size, and Splunk worked fine. However - it is not possible to see an event this large in the Splunk UI. Or at least, you can't view the entire event all at once. But it is there in Splunk...
Splunk limits events to 10000 characters by default. So in addition to setting MAX_EVENTS
, you may also want to set TRUNCATE
TRUNCATE = 0
means "never truncate" but you can also set a large integer value as well...
The Splunk indexer does not really care about silly human things like line breaks or lengths. 🙂 These settings are to keep things sane for us. I have seen events that were over 10K in size, and Splunk worked fine. However - it is not possible to see an event this large in the Splunk UI. Or at least, you can't view the entire event all at once. But it is there in Splunk...
This worked exactly as I needed, thank you! I now have beautiful 281 line events, ha!
I will give this a try and see if it resolves the problem tomorrow morning. Thank you for the feedback either way!