Dashboards & Visualizations

XML event truncated at 10k

kmattern
Builder

I've indexed a large XML database and have been searching it successfully. There is one field that contains a description. This description can be very long, well over 10kb.

in props.conf I have set TRUNCATE=0

In limits.conf I have set maxvaluesize=0

But my event still gets cut off at 10k. What am I missing?

Tags (3)
0 Karma

lguinn2
Legend

Perhaps you also need to set MAX_EVENTS, which is the maximum number of lines in an event. The default is 256. This attribute should be set in props.conf

MAX_EVENTS=2000

for example

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...