Getting Data In

Splunk v6.0.x - LineBreakingProcessor - remote_searches.log

BP9906
Builder


07-16-2014 10:45:21.533 -0700 WARN LineBreakingProcessor - Truncating line because limit of 10000 bytes has been exceeded with a line length >= 11179 - data_source="/opt/splunk/var/log/splunk/remote_searches.log", data_host="XXXXXXXXX", data_sourcetype="splunkd_remote_searches"

Why does Splunk v6.0.x keep logging this on the indexers?

1 Solution

somesoni2
SplunkTrust
SplunkTrust

These event truncation message appear when a log file which is being indexed in Splunk exceeds default maximum event size limit of 10,000 bytes (characters). As per the error entry, event size for one of the log entries for the file "remote_searches.log" was 11179 which was higher than 10,000 and due to which truncated the entry to 10,000 bytes.

To resolve this error, you would have to update the sourcetype definition for splunkd_remote_search.

On the indexer, etc/system/local/props.conf add following

[splunkd_remote_searches]
TRUNCATE = 15000           *** or any other suitable number

View solution in original post

brianpaulsuther
Explorer

Doesn't seem to be taking raised value.

0 Karma

brianpaulsuther
Explorer

Trying this at the moment..

0 Karma

somesoni2
SplunkTrust
SplunkTrust

These event truncation message appear when a log file which is being indexed in Splunk exceeds default maximum event size limit of 10,000 bytes (characters). As per the error entry, event size for one of the log entries for the file "remote_searches.log" was 11179 which was higher than 10,000 and due to which truncated the entry to 10,000 bytes.

To resolve this error, you would have to update the sourcetype definition for splunkd_remote_search.

On the indexer, etc/system/local/props.conf add following

[splunkd_remote_searches]
TRUNCATE = 15000           *** or any other suitable number

dshpritz
SplunkTrust
SplunkTrust

Also note that if you are using Splunk_SA_CIM and have data model accelerations enabled, you will see a lot of these.

0 Karma

BP9906
Builder

I added this, thanks. I'm aware of this setting, I just wanted to post because perhaps the default for this sourcetype should be adjusted in future release.
Thank you.

0 Karma

BP9906
Builder

I added this, thanks. I'm aware of this setting, I just wanted to post because perhaps the default for this sourcetype should be adjusted in future release.
Thank you.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...