Hi,
We have a problem with parsing logic which generates hundreds of thousands of truncate warnings every hour:
06-21-2014 18:14:34.121 -0700 WARN LineBreakingProcessor - Truncating line because limit of 800 has been exceeded with a line length >= 6985 - data_source="/
this issue causes Indexers to choke and eventually create indexing lag.
can someone clarify how to disable indexing of LineBreakingProcessor Warnings in _internal index?
i have tried updating /app/share/splunk/etc/log.cfg category.TailingProcessor=INFO to ERROR but it didnt work.
thanks,
... View more