Getting Data In

Impact of LineBreakingProcessor and AggregateMiningProcessor on indexing performance

swatishs
Explorer

When indexing a directory containing html files, log files, zipped log files and gzipped log files, I am getting many LineBreakingProcessor and AggregateMiningProcessor warnings. It is scattered with them.
LineBreakingProcessor: When a line exceepds a predefined lenght (default 10,000bytes)
AggregateMiningProcessor: When an event has more than 256 lines.

Can someone please elaborate more on the performance impact of these?

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...