Getting Data In

Why is my JSON format log getting truncated to 26 lines?

pmosca
New Member

I have a log file which has JSON format lines in the middle. The log looks fine but the JSON lines are getting truncated to 26 lines out of around 200 lines.

Is there a way I can extract the full log without any truncation?

0 Karma

ddrillic
Ultra Champion

TRUNCATE = 0 will keep you free ; -)

0 Karma

Vijeta
Influencer

@ddrillic Isn't that something Splunk doesn't recomment?

0 Karma

ddrillic
Ultra Champion

It really depends on your own best practice. If you can ensure that each event is of reasonable size than TRUNCATE = 0 is good. I used it and it was just fine.

0 Karma

Vijeta
Influencer

What is your MAX_EVENTS and TRUNCATE in props.conf for this sourcetype?

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...