Hi the splunk is running on a centos 7 and me as root where do I find the truncate value? the syslog output is the standart I have been using another system graylog and it has no problem parsing the data as for limits.conf that is what I have: [root@vpngw ~]# locate limits.conf /etc/security/limits.conf /opt/splunk/etc/apps/SplunkLightForwarder/default/limits.conf /opt/splunk/etc/system/README/limits.conf.example /opt/splunk/etc/system/README/limits.conf.spec /opt/splunk/etc/system/default/limits.conf /usr/share/man/man5/limits.conf.5.gz [root@vpngw ~]# ls -al /etc/security/limits.conf -rw-r--r-- 1 root root 2422 Nov 6 01:14 /etc/security/limits.conf [root@vpngw ~]# ls -al /opt/splunk/etc/apps/SplunkLightForwarder/default/limits.conf -r--r--r-- 1 splunk splunk 42 Mar 30 03:56 /opt/splunk/etc/apps/SplunkLightForwarder/default/limits.conf [root@vpngw ~]# ls -al /opt/splunk/etc/system/README/limits.conf.example -r--r--r-- 1 splunk splunk 2970 Mar 30 03:56 /opt/splunk/etc/system/README/limits.conf.example [root@vpngw ~]# ls -al /opt/splunk/etc/system/README/limits.conf.spec -r--r--r-- 1 splunk splunk 94776 Mar 30 03:56 /opt/splunk/etc/system/README/limits.conf.spec [root@vpngw ~]# ls -al /opt/splunk/etc/system/default/limits.conf -r--r--r-- 1 splunk splunk 29990 Apr 6 09:15 /opt/splunk/etc/system/default/limits.conf ... View more

Error in 'rex' command: regex="(?ms)^(?:[^'\n]'){3}(?P[^']+)[^=\n]='(?P[^']+)(?:[^'\n]'){6}(?P[^']+)(?:[^=\n]=){4}'(?P\d+.\d+)" has exceeded configured match_limit, consider raising the value in limits.conf Search results may be incomplete: the search process on the local peer:vpngw.pineapp.com ended prematurely. Please check the local peer log, such as $SPLUNK_HOME/var/log/splunk/splunkd.log and as well as the search.log for the particular search. Select Fields Highlight one or more values in the sample event to create fields. You can indicate one value is required, meaning it must exist in an event for the regular expression to match. Click on highlighted values in the sample event to modify them. To highlight text that is already part of an existing extraction, first turn off the existing extractions. Learn more Apr 6 17:52:51 46.166.130.92 Apr 6 17:49:32 Mx4 pamsgprocess[13121]: [START] [MID]='9000000000002292032', [time]='2017-04-06 17:49:32.617832', [sender]='info@INHUMAN.nl', [subject]='(null)', [size]='4030', [source_ip]='14.186.113.222', [commtouch_ref]='SPAM, OK, (300)(1000)gggruggvucftvghtrhhoucdtuddrfeeliedrtdeggdeivdcutefuodetggdotefrodftvfcurfhrohhfihhlvgemucfrkffpgfetrffrnecuuegrihhlohhuthemuceftddtnecujfgurhcugedtheeiucdlfedttddmnecujfgurhephffvufffgggtrfgikgfoqfesrgdttdepfidtnecuhfhrohhmpedfvfgrthihrghnrgdfuceoihhnfhhosefkpffjfgfotefprdhnlheqnecukfhppedugedrudekiedruddufedrvddvvd'[Content Filter]='Not Found', [MID]='9000000000002292032', [spam_score]='100.0 ', [type]='Spam', [status]='BLOCKED', [virus_details]='No Virus found', [direction]='R2L', [recipient]='emilya@ackerstein.co.il' [FINISH] ... View more