Splunk Enterprise

Troubleshooting
Use Cases

11
 Soft Mania

Event Truncation Issues

Issue: Json Data - Events are
truncated, only half of the event is
indexed

Only 10,000
Characters got indexed
{
JSON Event with
24,000 Characters
...................................
...................................
...................................
...................................
...................................
...................................
...................................
....

@SoftMania #SoftMania
 Soft Mania

Event Truncation Issues

Root Cause:
Event size is too big - more than 10,000 bytes

Only 10,000
Characters got indexed
{
JSON Event with
24,000 Characters
...................................
...................................
...................................
...................................
...................................
...................................
...................................
....

@SoftMania #SoftMania
 Soft Mania

Event Truncation Issues

Solution:
Configure “TRUNCATE” property in the
sourcetype, as shown below in props.conf

@SoftMania #SoftMania