- Splunk Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: Splunk v6.0.x - LineBreakingProcessor - remote...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
07-16-2014 10:45:21.533 -0700 WARN LineBreakingProcessor - Truncating line because limit of 10000 bytes has been exceeded with a line length >= 11179 - data_source="/opt/splunk/var/log/splunk/remote_searches.log", data_host="XXXXXXXXX", data_sourcetype="splunkd_remote_searches"
Why does Splunk v6.0.x keep logging this on the indexers?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
These event truncation message appear when a log file which is being indexed in Splunk exceeds default maximum event size limit of 10,000 bytes (characters). As per the error entry, event size for one of the log entries for the file "remote_searches.log" was 11179 which was higher than 10,000 and due to which truncated the entry to 10,000 bytes.
To resolve this error, you would have to update the sourcetype definition for splunkd_remote_search.
On the indexer, etc/system/local/props.conf add following
[splunkd_remote_searches]
TRUNCATE = 15000 *** or any other suitable number
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Doesn't seem to be taking raised value.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Trying this at the moment..
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
These event truncation message appear when a log file which is being indexed in Splunk exceeds default maximum event size limit of 10,000 bytes (characters). As per the error entry, event size for one of the log entries for the file "remote_searches.log" was 11179 which was higher than 10,000 and due to which truncated the entry to 10,000 bytes.
To resolve this error, you would have to update the sourcetype definition for splunkd_remote_search.
On the indexer, etc/system/local/props.conf add following
[splunkd_remote_searches]
TRUNCATE = 15000 *** or any other suitable number
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Also note that if you are using Splunk_SA_CIM and have data model accelerations enabled, you will see a lot of these.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I added this, thanks. I'm aware of this setting, I just wanted to post because perhaps the default for this sourcetype should be adjusted in future release.
Thank you.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I added this, thanks. I'm aware of this setting, I just wanted to post because perhaps the default for this sourcetype should be adjusted in future release.
Thank you.
They're back! Join the SplunkTrust and MVP at .conf24
Enterprise Security Content Update (ESCU) | New Releases
Detecting Remote Code Executions With the Splunk Threat Research Team
