Getting Data In
Highlighted

Splunk v6.0.x - LineBreakingProcessor - remote_searches.log

Builder


07-16-2014 10:45:21.533 -0700 WARN LineBreakingProcessor - Truncating line because limit of 10000 bytes has been exceeded with a line length >= 11179 - datasource="/opt/splunk/var/log/splunk/remotesearches.log", datahost="XXXXXXXXX", datasourcetype="splunkdremotesearches"

Why does Splunk v6.0.x keep logging this on the indexers?

Highlighted

Re: Splunk v6.0.x - LineBreakingProcessor - remote_searches.log

SplunkTrust
SplunkTrust

These event truncation message appear when a log file which is being indexed in Splunk exceeds default maximum event size limit of 10,000 bytes (characters). As per the error entry, event size for one of the log entries for the file "remote_searches.log" was 11179 which was higher than 10,000 and due to which truncated the entry to 10,000 bytes.

To resolve this error, you would have to update the sourcetype definition for splunkdremotesearch.

On the indexer, etc/system/local/props.conf add following

[splunkd_remote_searches]
TRUNCATE = 15000           *** or any other suitable number

View solution in original post

Highlighted

Re: Splunk v6.0.x - LineBreakingProcessor - remote_searches.log

Builder

I added this, thanks. I'm aware of this setting, I just wanted to post because perhaps the default for this sourcetype should be adjusted in future release.
Thank you.

0 Karma
Highlighted

Re: Splunk v6.0.x - LineBreakingProcessor - remote_searches.log

Builder

I added this, thanks. I'm aware of this setting, I just wanted to post because perhaps the default for this sourcetype should be adjusted in future release.
Thank you.

0 Karma
Highlighted

Re: Splunk v6.0.x - LineBreakingProcessor - remote_searches.log

SplunkTrust
SplunkTrust

Also note that if you are using SplunkSACIM and have data model accelerations enabled, you will see a lot of these.

0 Karma
Highlighted

Re: Splunk v6.0.x - LineBreakingProcessor - remote_searches.log

Trying this at the moment..

0 Karma
Highlighted

Re: Splunk v6.0.x - LineBreakingProcessor - remote_searches.log

Doesn't seem to be taking raised value.

0 Karma