Getting Data In

Splunk is not showing entire log entries

lyonsm
New Member

We are experiencing an issue with Splunk not showing entire log entries. For example if we look at a log in splunk for 1pm and that log has 50 lines with an option to expand to 66 line and then we look at the same log in the log file itself the log file will show that particular entry as having 100 or more lines. Is there a way to fix this issue?

Tags (1)
0 Karma

bmacias84
Champion

Ok, Make sure you have your event breaking correct. I am guessing that your events are exceeding the 10000 bytes default limit for an event. In your props.conf create TRUNCATE settings or enter TRUNCATE = 0 if you ever want an event to be truncated under your sourcetype stanza. There can be performance implications when increasing TRUNCATE.

Hope this helps or gets you started. Dont forget to accept and vote up answers.

Cheers,

0 Karma

Ayn
Legend

Are you sure you configured event breaking correctly, or might it be that Splunk is breaking events where you wouldn't expect it to?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...