We have XML events that seem to be getting truncated by splunk and we are not sure why? We are feeding the data through a UDP burst and it just cuts off:
Aug 29 16:14:22 10.142.102.50 Aug 29 16:14:22 pl-wlmuatdp4 [dv05_sr][21C_logs][error] mpgw(PayloadLoggingService): trans(79014981)[request]:
,Timestamp=2013-08-29T16:14:22-04:00,Env=DEV_XML,Source=DMZ,Operation=RateConversion2,Request=<?xml version="1.0" encoding="UTF-8"?>
<env:Envelope xmlns:env="removed" xmlns:xsd="removed" xmlns:xsi="removed" xmlns:dplog="removed" xmlns:SOAP-ENV="removed">
<env:Header/>
<env:Body>
<calculateFinalPremiumComposite xmlns="removed">
<requestHeader>
<userId>138</userId>
<systemDateTime>2013-08-02T07:19:57.305Z</systemDateTime>
<systemName>QFRS</systemName>
<messageReference>6faf94973c185e0a</messageReference>
<functionName>03</functionName>
<transac
does anyone know of any limits on the number of characters per event? Can anyone think of another reason this data would be truncated? Note I had to sensor data aboe to remove web addresses.
... View more