Why are logs are being cut off?

[lawrence_magpoc]

Some of the logs ingested into our Splunk environment has missing line. I was told that this could be the result of a delay in completion of logs. Is there a way around this?

[jarizeloyola]

Missing or Truncated? By default Splunk default maximum line length is 10000, in bytes.
If your event is more than the default value you can increase the TRUNCATE value in props.conf but never ever set it to 0.
Make sure that you set properly the props.conf of the sourcetype of that data.
- DATETIME_CONFIG
- TIME_PREFIX
- TIME_FORMAT
- MAX_TIMESTAMP_LOOKAHEAD
- TZ
- LINE_BREAKER
- SHOULD_LINEMERGE

Check splunkd.log for messages such as "AggregatorMiningProcessor" to know more what's happening

[richgalloway]

More information, please. What type of file(s)? How are they being ingested? What are the inputs.conf settings?