Why is my JSON format log getting truncated to 26 ...

pmosca · ‎10-01-2018

I have a log file which has JSON format lines in the middle. The log looks fine but the JSON lines are getting truncated to 26 lines out of around 200 lines.

Is there a way I can extract the full log without any truncation?

ddrillic · ‎10-01-2018

TRUNCATE = 0 will keep you free ; -)

Vijeta · ‎10-01-2018

@ddrillic Isn't that something Splunk doesn't recomment?

ddrillic · ‎10-01-2018

It really depends on your own best practice. If you can ensure that each event is of reasonable size than TRUNCATE = 0 is good. I used it and it was just fine.

Vijeta · ‎10-01-2018

What is your MAX_EVENTS and TRUNCATE in props.conf for this sourcetype?

Why is my JSON format log getting truncated to 26 lines?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

Join the Conversation