Getting Data In

Why is my JSON format log getting truncated to 26 lines?

pmosca
New Member

I have a log file which has JSON format lines in the middle. The log looks fine but the JSON lines are getting truncated to 26 lines out of around 200 lines.

Is there a way I can extract the full log without any truncation?

0 Karma

ddrillic
Ultra Champion

TRUNCATE = 0 will keep you free ; -)

0 Karma

Vijeta
Influencer

@ddrillic Isn't that something Splunk doesn't recomment?

0 Karma

ddrillic
Ultra Champion

It really depends on your own best practice. If you can ensure that each event is of reasonable size than TRUNCATE = 0 is good. I used it and it was just fine.

0 Karma

Vijeta
Influencer

What is your MAX_EVENTS and TRUNCATE in props.conf for this sourcetype?

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...