We have XML events that seem to be getting truncated by splunk and we are not sure why? We are feeding the data through a UDP burst and it just cuts off:
Aug 29 16:14:22 10.142.102.50 Aug 29 16:14:22 pl-wlmuatdp4 [dv05_sr][21C_logs][error] mpgw(PayloadLoggingService): trans(79014981)[request]: ,Timestamp=2013-08-29T16:14:22-04:00,Env=DEV_XML,Source=DMZ,Operation=RateConversion2,Request=<?xml version="1.0" encoding="UTF-8"?> <env:Envelope xmlns:env="removed" xmlns:xsd="removed" xmlns:xsi="removed" xmlns:dplog="removed" xmlns:SOAP-ENV="removed"> <env:Header/> <env:Body> <calculateFinalPremiumComposite xmlns="removed"> <requestHeader> <userId>138</userId> <systemDateTime>2013-08-02T07:19:57.305Z</systemDateTime> <systemName>QFRS</systemName> <messageReference>6faf94973c185e0a</messageReference> <functionName>03</functionName> <transac
does anyone know of any limits on the number of characters per event? Can anyone think of another reason this data would be truncated? Note I had to sensor data aboe to remove web addresses.
