Hi All,
I setup one universal forwarder on my windows server and forward the logs to my linux splunk instance, and the events are truncated to 10000.
I tried set the truncate settings in my forwarder, and it doesn’t work at all, here’s my configuration:
E:\services\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\local\inputs.conf
[monitor://E:\logs]
**TRUNCATE = 0**
disabled = false
Can someone help that?
You need to put the TRUNCATE setting in the indexer, in a props.conf file
something like:
[yoursourcetype]
TRUNCATE = 0
Restart the indexer after changing this setting
Regards
You need to put the TRUNCATE setting in the indexer, in a props.conf file
something like:
[yoursourcetype]
TRUNCATE = 0
Restart the indexer after changing this setting
Regards
Thanks all. We resolved the issue with heavy forwarder instead of universal forwarder. The TRUNCATE setting doesn't work in universal forwarder not matter i put it into the props.conf or input.conf.
Final solution:
1. added below configuration in indexer's props.conf.
[yoursourcetype]
TRUNCATE = 0
Setup one heavy forwarder (install full splunk and change it's license to forwarder).
Added below configuration in heavy forwarder's etc\
system\local\props.conf
[yoursourcetype]
TRUNCATE = 0
it works as excepted.
This attribute is applicable for props.conf only (on indexer). Inputs.conf (on universal forwarder) need not be changed.
Thanks. I will try. Besides, do i need modify the inputs.conf and props.conf both?