Event Truncation Issues | Splunk Enterprise Troubleshooting Use Cases - 11 | Soft Mania

Описание: Event Truncation Issues | Splunk Enterprise Troubleshooting Use Cases - 11

Event Truncation Issues:

Issue-5: Json Data - Events are truncated, only half of the event is indexed

Root Cause: Event size is too big - more than 10,000 bytes

Solution: Configure “TRUNCATE” property in the sourcetype, as shown below in props.conf

[yoursourcetype]
TRUNCATE = 99999

#splunk #splunkadmin #splunkblogs #splunkengineer #splunklife #softmania #splunkmania #troubleshooting #splunktroubleshooting