Splunk Search for Sourcetypes that are Being Truncated Copy
index=_internal sourcetype=splunkd "truncating line" | rex field=_raw "line length\s+>=\s+(?<length>\d+)" | search length=* | stats max(length) as length, count by data_sourcetype
0 comments