Splunk is breaking my events in to two events

[aleem]

Hi,
I have events with 360 lines of text.

My problem is that Splunk
1. writes the first 257 lines of the event
2. writes the next event that happends to have the same timestamp
3. finishes off the writing the remaining 104 lines of the first event as a new event

I am not sure if having 360 lines in an event causes a bottle neck or if I need to modify a file somewhere.

Hopefully, it is a simple config update 😉

[Ayn]

The docs page for props.conf is your friend here. Specifically, the MAX_EVENTS default value is likely to cause the effect you're seeing:

MAX_EVENTS = <integer>
* Specifies the maximum number of input lines to add to any event.
* Splunk breaks after the specified number of lines are read.
* Defaults to 256 (lines).

[aleem]

Sounds great Ayn. I'll have a go at doing this and feedback 😉