How do I find events causing LineBreakingProcessor Warning?

[dwoltil]

I am getting over 1,000 of theses warnings in the splunkd.log every minute on one of our indexers.
We are on version 4.3.1 build 119532

WARN LineBreakingProcessor - Truncating line because limit of 10000 has been exceeded: 23824
WARN LineBreakingProcessor - Truncating line because limit of 10000 has been exceeded: 33824
WARN LineBreakingProcessor - Truncating line because limit of 10000 has been exceeded: 31056
...etc

I know I can edit props.conf to change the truncate setting (http://splunk-base.splunk.com/answers/41648/linebreakingprocessor-truncating-line-because-limit-of-1...) but I want to find what events are causing these warning so I can make sure the sender is not incorrectly configured or sending junk data.

How can I identify these extremely long events?

[sdwilkerson · Accepted solution]

Dwoltil,

Here are two methods:

• You can put that specific element in "debug" mode to see more in your splunkd.log by following these instructions: http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/Enabledebuglogging#Enable_debug_m...
• Or you can do a search to see which events were 10,000 bytes big, for instance, try something like this in your search: index=* | eval size=len(_raw) | where size=10000

The search above should return the events that are 10000 bytes long or rather, the ones that will hit the default TRUNCATE limit. Instead of the equal sign after size, you can instead use the greater than or less than character if you prefer to fine tune what you are looking for.

Best,

Sean