Monitoring Splunk
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
- Find Answers
- :
- Splunk Administration
- :
- Monitoring Splunk
- :
- Re: How to increase 'Crash log' size?
Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
jawaharas
Motivator
07-09-2019
10:13 PM
Splunk instance crashed with incomplete crash file (crash.log*) under $SPLUNK_HOME/splunk/var/log/splunk/.
The crash log file is seems truncated with below error and so, it's not useful for troubleshooting.
Crash log has overflowed the allowed limit (512kB), truncated
How to increase crash log file size? Any help is welcome one. Thanks.
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
jawaharas
Motivator
09-09-2019
10:27 PM
Let me answer to my own question with the inputs from Splunk support.
512kb limit for crash log is hardcoded in Splunk crash dump creation code. It is a pretty reasonable size and captures the necessary information.
Some crashes, like ones from a search process, may contain the last lines from the search.log and could get cut off. The setting itself is NOT configurable unfortunately.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
jawaharas
Motivator
09-09-2019
10:27 PM
Let me answer to my own question with the inputs from Splunk support.
512kb limit for crash log is hardcoded in Splunk crash dump creation code. It is a pretty reasonable size and captures the necessary information.
Some crashes, like ones from a search process, may contain the last lines from the search.log and could get cut off. The setting itself is NOT configurable unfortunately.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
jaime_ramirez
Communicator
08-05-2019
03:50 PM
For some of the log inputs you can change the default settings in the $SPLUNK_HOME/etc/log.cfg file. Although for the crash log I havent found anything yet.
Have you tried contacting Splunk support on this issue?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
jawaharas
Motivator
08-05-2019
04:25 PM
I haven't. I will raise a Splunk support case and update here if I found solution. Cheers.
Get Updates on the Splunk Community!
See your relevant APM services, dashboards, and alerts in one place with the updated ...
As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...
Index This | What goes away as soon as you talk about it?
May 2025 Edition
Hayyy Splunk Education Enthusiasts and the Eternally Curious!
We’re back with this month’s ...
What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025
This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...
