Splunk is not showing entire log entries

[lyonsm]

We are experiencing an issue with Splunk not showing entire log entries. For example if we look at a log in splunk for 1pm and that log has 50 lines with an option to expand to 66 line and then we look at the same log in the log file itself the log file will show that particular entry as having 100 or more lines. Is there a way to fix this issue?

[bmacias84]

Ok, Make sure you have your event breaking correct. I am guessing that your events are exceeding the 10000 bytes default limit for an event. In your props.conf create TRUNCATE settings or enter TRUNCATE = 0 if you ever want an event to be truncated under your sourcetype stanza. There can be performance implications when increasing TRUNCATE.

Hope this helps or gets you started. Dont forget to accept and vote up answers.

Cheers,

[Ayn]

Are you sure you configured event breaking correctly, or might it be that Splunk is breaking events where you wouldn't expect it to?