Splunk v6.0.x - LineBreakingProcessor - remote_searches.log

[BP9906]


07-16-2014 10:45:21.533 -0700 WARN LineBreakingProcessor - Truncating line because limit of 10000 bytes has been exceeded with a line length >= 11179 - data_source="/opt/splunk/var/log/splunk/remote_searches.log", data_host="XXXXXXXXX", data_sourcetype="splunkd_remote_searches"


Why does Splunk v6.0.x keep logging this on the indexers?

[brianpaulsuther]

Doesn't seem to be taking raised value.

[brianpaulsuther]

Trying this at the moment..

[somesoni2 · Accepted solution]

These event truncation message appear when a log file which is being indexed in Splunk exceeds default maximum event size limit of 10,000 bytes (characters). As per the error entry, event size for one of the log entries for the file "remote_searches.log" was 11179 which was higher than 10,000 and due to which truncated the entry to 10,000 bytes.

To resolve this error, you would have to update the sourcetype definition for splunkd_remote_search.

On the indexer, etc/system/local/props.conf add following

[splunkd_remote_searches]
TRUNCATE = 15000           *** or any other suitable number

[dshpritz]

Also note that if you are using Splunk_SA_CIM and have data model accelerations enabled, you will see a lot of these.

[BP9906]

I added this, thanks. I'm aware of this setting, I just wanted to post because perhaps the default for this sourcetype should be adjusted in future release.
Thank you.

[BP9906]

I added this, thanks. I'm aware of this setting, I just wanted to post because perhaps the default for this sourcetype should be adjusted in future release.
Thank you.