TRUCANTE Logs

[andgarciaa]

Hello,

I am using Splunk Cloud, for some our sourcetypes we have defined specific TRUNCATE values. I have a couple of questions.

If `TRUNCATE` value is not defined for a sourcetype, what is the default limit of chars?

Is there any guideline document or rules on how to define TRUNCATE? Especially if it is recommended to set something higher than 50k or 80k chars as a limit.

[gcusello · Accepted solution]

Hi @andgarciaa ,

you can find more infos at https://docs.splunk.com/Documentation/Splunk/9.2.1/Admin/Propsconf

and answering to your question:

TRUNCATE = <non-negative integer>
* The default maximum line length, in bytes.
* Although this is in bytes, line length is rounded down when this would
  otherwise land mid-character for multi-byte characters.
* Set to 0 if you never want truncation (very long lines are, however, often
  a sign of garbage data).
* Default: 10000

There isn't a general guideline: usually the TRUNCATE value is defined by the specific Add-On you're using and it's related to the technology you're using.

If you are ingesting a custom log, you have to choose the correct one by yourself.

Ciao.

Giuseppe