Monitoring Splunk

How to increase 'Crash log' size?

jawaharas
Motivator

Splunk instance crashed with incomplete crash file (crash.log*) under $SPLUNK_HOME/splunk/var/log/splunk/.

The crash log file is seems truncated with below error and so, it's not useful for troubleshooting.
Crash log has overflowed the allowed limit (512kB), truncated

How to increase crash log file size? Any help is welcome one. Thanks.

Labels (2)
1 Solution

jawaharas
Motivator

Let me answer to my own question with the inputs from Splunk support.

512kb limit for crash log is hardcoded in Splunk crash dump creation code. It is a pretty reasonable size and captures the necessary information.

Some crashes, like ones from a search process, may contain the last lines from the search.log and could get cut off. The setting itself is NOT configurable unfortunately.

View solution in original post

jawaharas
Motivator

Let me answer to my own question with the inputs from Splunk support.

512kb limit for crash log is hardcoded in Splunk crash dump creation code. It is a pretty reasonable size and captures the necessary information.

Some crashes, like ones from a search process, may contain the last lines from the search.log and could get cut off. The setting itself is NOT configurable unfortunately.

jaime_ramirez
Communicator

For some of the log inputs you can change the default settings in the $SPLUNK_HOME/etc/log.cfg file. Although for the crash log I havent found anything yet.

Have you tried contacting Splunk support on this issue?

0 Karma

jawaharas
Motivator

I haven't. I will raise a Splunk support case and update here if I found solution. Cheers.

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...