I am using Splunk 7.1.1 and i have been getting this error constantly
LineBreakingProcessor - Truncating line because limit of 10000 bytes has been exceeded
As per various Splunk answers, I tried TRUNCATE=0 & TRUNCATE=999999 as well, but none of them worked for me. I had made sure the setting are in the correct props.conf
Any suggestions how do i get rid of this error?
LineBreaking is done as part of parsing pipeline:
More details about event processing pipelines:
Please note sometime parsing can be done by the Heavy Forwarder:
If by any chance you have HF doing the parsing, perhaps you should apply relevant props.conf on the Heavy Forwarder.
You may check splunkd.log on relevant Splunk components searching for "truncating" and look for if the particular log is getting truncated due to any setting.