Getting Data In

setting maximum input/log entry size

tedder
Communicator

So I have the following in inputs.conf:

[udp://10005]
connection_host =
index = serverlogs
sourcetype = syslog
disabled = 1

The entries appear to be truncated; how do I increase the input length so I can get full stack traces, for instance? What's the default length?

Tags (1)
0 Karma
1 Solution

ziegfried
Influencer

You might want to take a look at the line-breaking/merging options in props conf. http://www.splunk.com/base/Documentation/latest/Admin/Propsconf

Especially TRUNCATE and MAX_EVENTS.


Update:

TRUNCATE is set to 10000 by default and MAX_EVENTS to 256. Probably MAX_EVENTS is the bottleneck in your case. You could try setting the following in $SPLUNK_HOME/etc/system/local/props.conf:

[syslog]
MAX_EVENTS=1000

Which would allow 1000 lines to be merged to a single event.

If you're using Splunk in LWF (lightweight forwarder) mode on the forwarder, then you have to configure this on the indexer, otherwise on the forwarder.

View solution in original post

0 Karma

ziegfried
Influencer

You might want to take a look at the line-breaking/merging options in props conf. http://www.splunk.com/base/Documentation/latest/Admin/Propsconf

Especially TRUNCATE and MAX_EVENTS.


Update:

TRUNCATE is set to 10000 by default and MAX_EVENTS to 256. Probably MAX_EVENTS is the bottleneck in your case. You could try setting the following in $SPLUNK_HOME/etc/system/local/props.conf:

[syslog]
MAX_EVENTS=1000

Which would allow 1000 lines to be merged to a single event.

If you're using Splunk in LWF (lightweight forwarder) mode on the forwarder, then you have to configure this on the indexer, otherwise on the forwarder.

0 Karma

ziegfried
Influencer

Updated the answer...

0 Karma

tedder
Communicator

Thanks, Ziegfried. I'm seeing ~2000 characters, but [SYSLOG] isn't set to "TRUNCATE=2000". In fact, that one isn't set. Is 2000 a default? If I add "TRUNCATE=10000, will that do it? (and does this go on my forwarder or my indexers?)

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...