Why is Splunk cutting off the data received with collect command?

[benhurbarbieri]

Splunk is cutting some data that is received through collect made on a server.

I have already reviewed the props.conf and inputs.conf files.

Has anyone seen anything about this?

Thankful.

[nadlurinadluri]

Ideally collect command is used only for statistical data, and I dont exactly understand as on what data is missing once you use collect command!! Can you elaborate?

[pruthvikrishnap]

Hi Ben,
Try adding the complete values to your search try mentioning the complete index, source-type etc.

| collect index=summary sourcetype=foo

Re-check if any regex is applied on any field.
Share few samples on what is missing, may be we can look into it.
Let me know if this helps.

[horsefez]

Hi @benhurbarbieri,

it's not so clear what you are talking about, but I guess you are talking about Event-Breaking.
Maybe data is coming in and the event isn't breaking at the timestamp you configured.
Stuff like that is pretty common.

To help you, you need to post some sample data and the corresponding stanza's in props/transforms.conf if there are any.