**I have in the input.conf as an example a scripted input on the server where the Splunk Universal Forwarder is installed**
[script://.\bin\LongRunningQueriesRpt.path]
interval=*/1 * * * 1-5
disabled = 0
sourcetype = csv
send_index_as_argument_for_path = 0
**In the input file is the execution of the Powershell Script.**
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -File "$SPLUNK_HOME\etc\apps\appname\bin\LongRunningQueriesRpt.ps1"
**It runs fine but in the splunkd.log file I am seeing line Breaking Processor warning messages as noted below.**
WARN LineBreakingProcessor - Truncating line because limit of 10000 bytes has been exceeded with a line length
>= 50869 - data_source="C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -File "C:\Program Files\SplunkUniversalForwarder\etc\apps\appname\bin\LongRunningQueriesRpt.ps1"", data_host="host_name", data_sourcetype="csv"
**I understand I have to update the props.conf file on the indexer as that is where the parsing happens. But I am not sure what to use, as the examples I've seen have been for log files. So, I am not sure what I should put in the source section to eliminate the messages. I only want/need to do this for this particular script. Any ideas I can try?**
[Source::?]
TRUNCATE = 0
**The above is what I want to use but Just not sure what to put into the source. Thanks in advance for any help anyone can provide.**
↧