Prevent splunk from splitting file dump into 2 events?

[msarro]

Hello,
I have a universal forwarders installed on several servers. Each one is configured to monitor a license utilization file which is regenerated every day by a piece of 3rd party software. However, the file is being split into two events for some reason on only a few of our servers. The split always occurs at 257 lines.

Our props.conf file on our indexers reads like this:
[TRUNKING_AS_LICENSE_FILE]
MAX_TIMESTAMP_LOOKAHEAD = 40
TZ = UTC
MAX_EVENTS=10000

So what exactly would be causing the file to line break when I search with the search head? Is it a limit on the search head side of things to not show events longer than 256 lines? Any advice would be helpful.

[lguinn2 · Accepted solution]

Splunk limits events to 10000 characters by default. So in addition to setting MAX_EVENTS, you may also want to set TRUNCATE

TRUNCATE = 0

means "never truncate" but you can also set a large integer value as well...

The Splunk indexer does not really care about silly human things like line breaks or lengths. 🙂 These settings are to keep things sane for us. I have seen events that were over 10K in size, and Splunk worked fine. However - it is not possible to see an event this large in the Splunk UI. Or at least, you can't view the entire event all at once. But it is there in Splunk...

[msarro]

This worked exactly as I needed, thank you! I now have beautiful 281 line events, ha!

[msarro]

I will give this a try and see if it resolves the problem tomorrow morning. Thank you for the feedback either way!