Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- setting maximum input/log entry size
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
So I have the following in inputs.conf:
[udp://10005]
connection_host =
index = serverlogs
sourcetype = syslog
disabled = 1
The entries appear to be truncated; how do I increase the input length so I can get full stack traces, for instance? What's the default length?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You might want to take a look at the line-breaking/merging options in props conf. http://www.splunk.com/base/Documentation/latest/Admin/Propsconf
Especially TRUNCATE and MAX_EVENTS.
Update:
TRUNCATE is set to 10000 by default and MAX_EVENTS to 256. Probably MAX_EVENTS is the bottleneck in your case. You could try setting the following in $SPLUNK_HOME/etc/system/local/props.conf:
[syslog]
MAX_EVENTS=1000
Which would allow 1000 lines to be merged to a single event.
If you're using Splunk in LWF (lightweight forwarder) mode on the forwarder, then you have to configure this on the indexer, otherwise on the forwarder.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You might want to take a look at the line-breaking/merging options in props conf. http://www.splunk.com/base/Documentation/latest/Admin/Propsconf
Especially TRUNCATE and MAX_EVENTS.
Update:
TRUNCATE is set to 10000 by default and MAX_EVENTS to 256. Probably MAX_EVENTS is the bottleneck in your case. You could try setting the following in $SPLUNK_HOME/etc/system/local/props.conf:
[syslog]
MAX_EVENTS=1000
Which would allow 1000 lines to be merged to a single event.
If you're using Splunk in LWF (lightweight forwarder) mode on the forwarder, then you have to configure this on the indexer, otherwise on the forwarder.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Updated the answer...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks, Ziegfried. I'm seeing ~2000 characters, but [SYSLOG] isn't set to "TRUNCATE=2000". In fact, that one isn't set. Is 2000 a default? If I add "TRUNCATE=10000, will that do it? (and does this go on my forwarder or my indexers?)
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
SplunkTrust Application Period is Officially OPEN!
