Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

why events breaks after 257line when max_events=10000 ist set?

$
0
0

I have multi-line (Json) events and have configured the import by

NO_BINARY_CHECK=1 
BREAK_ONLY_BEFORE = ^    { 
KV_MODE = json 
MAX_EVENTS = 10000 
MAX_TIMESTAMP_LOOKAHEAD = 14 
NO_BINARY_CHECK = 1 
SHOULD_LINEMERGE = true 
TIME_PREFIX = "startTime": 
TRUNCATE = 0 
pulldown_type=1

but splunk still breaks the event after 257 lines.

best regards Marco


Viewing all articles
Browse latest Browse all 13053

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>