Getting Data In

Why is my JSON format log getting truncated to 26 lines?

pmosca
New Member

I have a log file which has JSON format lines in the middle. The log looks fine but the JSON lines are getting truncated to 26 lines out of around 200 lines.

Is there a way I can extract the full log without any truncation?

0 Karma

ddrillic
Ultra Champion

TRUNCATE = 0 will keep you free ; -)

0 Karma

Vijeta
Influencer

@ddrillic Isn't that something Splunk doesn't recomment?

0 Karma

ddrillic
Ultra Champion

It really depends on your own best practice. If you can ensure that each event is of reasonable size than TRUNCATE = 0 is good. I used it and it was just fine.

0 Karma

Vijeta
Influencer

What is your MAX_EVENTS and TRUNCATE in props.conf for this sourcetype?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...