Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: Prevent splunk from splitting file dump into 2...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
I have a universal forwarders installed on several servers. Each one is configured to monitor a license utilization file which is regenerated every day by a piece of 3rd party software. However, the file is being split into two events for some reason on only a few of our servers. The split always occurs at 257 lines.
Our props.conf file on our indexers reads like this:
[TRUNKING_AS_LICENSE_FILE]
MAX_TIMESTAMP_LOOKAHEAD = 40
TZ = UTC
MAX_EVENTS=10000
So what exactly would be causing the file to line break when I search with the search head? Is it a limit on the search head side of things to not show events longer than 256 lines? Any advice would be helpful.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Splunk limits events to 10000 characters by default. So in addition to setting MAX_EVENTS, you may also want to set TRUNCATE
TRUNCATE = 0
means "never truncate" but you can also set a large integer value as well...
The Splunk indexer does not really care about silly human things like line breaks or lengths. 🙂 These settings are to keep things sane for us. I have seen events that were over 10K in size, and Splunk worked fine. However - it is not possible to see an event this large in the Splunk UI. Or at least, you can't view the entire event all at once. But it is there in Splunk...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Splunk limits events to 10000 characters by default. So in addition to setting MAX_EVENTS, you may also want to set TRUNCATE
TRUNCATE = 0
means "never truncate" but you can also set a large integer value as well...
The Splunk indexer does not really care about silly human things like line breaks or lengths. 🙂 These settings are to keep things sane for us. I have seen events that were over 10K in size, and Splunk worked fine. However - it is not possible to see an event this large in the Splunk UI. Or at least, you can't view the entire event all at once. But it is there in Splunk...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This worked exactly as I needed, thank you! I now have beautiful 281 line events, ha!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I will give this a try and see if it resolves the problem tomorrow morning. Thank you for the feedback either way!
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
[Puzzles] Solve, Learn, Repeat: Matching cron expressions
Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass
May 2026 Splunk Expert Sessions: Security & Observability
