Getting Data In
Provide Splunk Cloud feedback in this confidential UX survey by June 17
for a chance to win a $200 Amazon gift card!

Uploaded a large dataset (CSV file) and the data is not displaying correctly

shukan
Explorer

Hi

I have upload a CSV file with a lot of data. In one of the column value about more then 1000 characters (with special characters) and 41 words, but all of the data is not displaying. Can you please tell what changes require to upload all data ?

Thank you in advance.

Tags (2)
0 Karma
1 Solution

s2_splunk
Splunk Employee
Splunk Employee

Take a look at the TRUNCATE setting in props.conf. You can find out whether that is your problem by looking for warning messages in splunkd.log: index=_internal sourcetype=splunkd log_level=WARN component=LineBreakingProcessor
The default is 10000 bytes, so I am not sure that is what you are running up against.

View solution in original post

s2_splunk
Splunk Employee
Splunk Employee

Take a look at the TRUNCATE setting in props.conf. You can find out whether that is your problem by looking for warning messages in splunkd.log: index=_internal sourcetype=splunkd log_level=WARN component=LineBreakingProcessor
The default is 10000 bytes, so I am not sure that is what you are running up against.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

What are your current props.conf settings for that sourcetype? What do you mean by "special characters"?

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!