Getting Data In
Highlighted

Why are logs are being cut off?

New Member

Some of the logs ingested into our Splunk environment has missing line. I was told that this could be the result of a delay in completion of logs. Is there a way around this?

0 Karma
Highlighted

Re: Why are logs are being cut off?

SplunkTrust
SplunkTrust

More information, please. What type of file(s)? How are they being ingested? What are the inputs.conf settings?

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: Why are logs are being cut off?

Path Finder

Missing or Truncated? By default Splunk default maximum line length is 10000, in bytes.
If your event is more than the default value you can increase the TRUNCATE value in props.conf but never ever set it to 0.
Make sure that you set properly the props.conf of the sourcetype of that data.
- DATETIMECONFIG
- TIME
PREFIX
- TIMEFORMAT
- MAX
TIMESTAMPLOOKAHEAD
- TZ
- LINE
BREAKER
- SHOULD_LINEMERGE

Check splunkd.log for messages such as "AggregatorMiningProcessor" to know more what's happening

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.