Splunk automatically breaking log entries after 100 lines.

[tmail037]

I am trying out Splunk and facing an issue. I have some large log entries in my log file, say 250 lines and I have defined 'BREAK_ONLY_BEFORE = some regex'. Now in addition to breaking before the given regex, Splunk also breaks the log entry after every 100 lines. This resulting in multiple events (in above case 3 events) for single log entry. I have tried this using Splunk web's 'Data Preview' feature.

My props.conf setting for the sourcetype

[dummy_source]

BREAK_ONLY_BEFORE=^\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}\s---\sERROR:\s

NO_BINARY_CHECK=1

SHOULD_LINEMERGE=true

Please help.

Edit- I tried setting

MAX_EVENTS = 1000

Now I am getting single event for each log entry but the problem now is, the event displayed is truncated. It does not seem to contain all the 250 lines from the log entry.

[tmail037 · Accepted solution]

I am updating this so that someday someone will benefit from it.

Its just the data preview UI which shows truncated logs. Actually the logs are not
truncated. Each event contains complete log entry.