LineBreakingProcessor question

[willemjongeneel]

Hello,

I receive errors like the ones below:
LineBreakingProcessor - Truncating line because limit of 132000 bytes has been exceeded with a line length >= 136321

I solved this before by just raising the TRUNCATE value. Still i get these errors. Is there a point where I should stop raising this value? Are there risks in setting this value to high?

Thanks, kind regards,
Willem

[MuS · Accepted solution]

Hi willemjongeneel,

the only risk will be to set it to TRUNCATE = 0 !
Everything else will help Splunk in knowing instead of guessing where to truncate and therefore it will increase the parsing performance of the Splunk instance.

Hope this helps ...

cheers, MuS

[willemjongeneel]

Yes that helps, thanks!

Kind regards,
Willem

[lakshman239]

Ideally you want to limit it TRUNCATE = 999999 to allow genuinely long lines instead of setting to 0 (never truncate).

[MuS]

Seriously if you have to set this value, you are best to either @#$@#$#$% or point your devs to this http://dev.splunk.com/view/logging/SP-CAAAFCK

Or use black magic or cough cribl cough to make the events useable 😉

cheers, MuS