Large events
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Large events
Lines over 10,000 bytes
Splunk will break lines over 10,000 bytes into multiple lines of 10,000 bytes each when indexing them. It will append the meta data field meta::truncated to the end of each truncated section. However, it will still group these lines into a single event.
Events over 100,000 bytes
Segments after the first 100,000 bytes of a very long line will be searchable, but Splunk will not display them in search results. It will only display the first 100,000 bytes.
Events over 1,000 segments
Splunk will only display the first 1,000 individual segments of an event as segments that are separated by whitespace and highlighted on mouseover. It will display the rest of the event as raw text without interactive formatting.
This documentation applies to the following versions of Splunk: 3.0 , 3.0.1 , 3.0.2 , 3.1 , 3.1.1 , 3.1.2 , 3.1.3 , 3.1.4 View the Article History for its revisions.