The default event size limit is 10000 characters. You can override this in props.conf as follows
[yoursourcetypehere]
TRUNCATE = 0
MAX_EVENTS = 10000
Setting TRUNCATE
to zero means "no truncation". MAX_EVENTS
actually sets "the maximum number of lines per event." MAX_EVENTS
only applies to multi-line events, but the default is 256 lines. If you are dealing with multi-line events, you may want to set this to a much larger value.
You can put the props.conf
file under an application, if it is application-specific, or under /etc/system/local
The default event size limit is 10000 characters. You can override this in props.conf as follows
[yoursourcetypehere]
TRUNCATE = 0
MAX_EVENTS = 10000
Setting TRUNCATE
to zero means "no truncation". MAX_EVENTS
actually sets "the maximum number of lines per event." MAX_EVENTS
only applies to multi-line events, but the default is 256 lines. If you are dealing with multi-line events, you may want to set this to a much larger value.
You can put the props.conf
file under an application, if it is application-specific, or under /etc/system/local
hi @lguinn2 , I updated the props.conf in my indexer and forwarder but my data still get truncated to 100 KB.
According to this answer https://answers.splunk.com/answers/155691/why-are-larger-events-are-truncated-10000-bytes.html .. I also need to update the Heavy Forwarder's props.conf file. Do you know how to find out if my data flows thru the HWF before getting into the indexer?