Getting Data In

Uploaded a large dataset (CSV file) and the data is not displaying correctly

shukan
Explorer

Hi

I have upload a CSV file with a lot of data. In one of the column value about more then 1000 characters (with special characters) and 41 words, but all of the data is not displaying. Can you please tell what changes require to upload all data ?

Thank you in advance.

Tags (2)
0 Karma
1 Solution

s2_splunk
Splunk Employee
Splunk Employee

Take a look at the TRUNCATE setting in props.conf. You can find out whether that is your problem by looking for warning messages in splunkd.log: index=_internal sourcetype=splunkd log_level=WARN component=LineBreakingProcessor
The default is 10000 bytes, so I am not sure that is what you are running up against.

View solution in original post

s2_splunk
Splunk Employee
Splunk Employee

Take a look at the TRUNCATE setting in props.conf. You can find out whether that is your problem by looking for warning messages in splunkd.log: index=_internal sourcetype=splunkd log_level=WARN component=LineBreakingProcessor
The default is 10000 bytes, so I am not sure that is what you are running up against.

richgalloway
SplunkTrust
SplunkTrust

What are your current props.conf settings for that sourcetype? What do you mean by "special characters"?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...