This documentation does not apply to the most recent version of Splunk.
This documentation applies to the following versions of Splunk: 3.0 , 3.0.1 , 3.0.2 , 3.1 , 3.1.1 , 3.1.2 , 3.1.3 , 3.1.4
Splunk will break lines over 10,000 bytes into multiple lines of 10,000 bytes each when indexing them. It will append the meta data field meta::truncated to the end of each truncated section. However, it will still group these lines into a single event.
Segments after the first 100,000 bytes of a very long line will be searchable, but Splunk will not display them in search results. It will only display the first 100,000 bytes.
Splunk will only display the first 1,000 individual segments of an event as segments that are separated by whitespace and highlighted on mouseover. It will display the rest of the event as raw text without interactive formatting.