Hello,
I would like to add a log file containing json documents - one json per line. The json documents are pretty long (longer than 10,000 characters) and I don't want them to get truncated so I set the props.conf as follows.
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = false
TRUNCATE = 0
KV_MODE=json
LINE_BREAKER=([\n\r]+)({)
During data preview, everything looks good. Nothing got truncated at all. However, once I completed the process and searched for it, the data is truncated to 10,000 characters, so Splunk doesn't interpret it as json.
I saw the warning in splunkd.log below.
WARN LineBreakingProcessor - Truncating line because limit of 10000 has been exceeded with a line length >= 10506 - data_source="/opt/readonly/log-archive/mylogfile.log", data_host="test", data_sourcetype="test"
Any help would be appreciated.
Thank you.
... View more