Getting Data In

Why am I getting the following error from the LineBreakingProcessor: "Truncating line because limit of 10000 bytes has been exceeded?"


Hi Team,

I am using Splunk 7.1.1 and i have been getting this error constantly

LineBreakingProcessor - Truncating line because limit of 10000 bytes has been exceeded

As per various Splunk answers, I tried TRUNCATE=0 & TRUNCATE=999999 as well, but none of them worked for me. I had made sure the setting are in the correct props.conf

Any suggestions how do i get rid of this error?

0 Karma

Splunk Employee
Splunk Employee

LineBreaking is done as part of parsing pipeline:

More details about event processing pipelines:

Please note sometime parsing can be done by the Heavy Forwarder:

If by any chance you have HF doing the parsing, perhaps you should apply relevant props.conf on the Heavy Forwarder.

You may check splunkd.log on relevant Splunk components searching for "truncating" and look for if the particular log is getting truncated due to any setting.

0 Karma


Make sure you have this configs on your indexers...

0 Karma


Did you restart splunkd after changing the props?
Maybe check spelling ?
Please post your conf

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...