Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Saving to index of large result sets is somehow limited or broken #49

Closed
atremar opened this issue Jan 4, 2015 · 1 comment
Closed

Saving to index of large result sets is somehow limited or broken #49

atremar opened this issue Jan 4, 2015 · 1 comment
Assignees
@simcen
Labels
bug
Milestone
v1.0 (Major Release)

Comments

@atremar
Copy link
Collaborator

atremar commented Jan 4, 2015

sourcetype = alert_results
There seems to be a limitation around 10000 characters per result event produced by alert_handler.py
If there is more data the result does not get written (indexed) completely and therefore breaks the JSON envelope.
@atremar
Copy link
Collaborator Author

atremar commented Jan 4, 2015

props.conf.[<...>].TRUNCATE

  • Defaults to 10000 bytes.

@simcen simcen added the bug label Jan 4, 2015
@simcen simcen added this to the v1.0 Release milestone Jan 4, 2015
@simcen simcen self-assigned this Jan 4, 2015
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@simcen simcen

Labels
bug
Projects
None yet
Milestone
v1.0 (Major Release)
Development

No branches or pull requests
2 participants
@atremar @simcen