Getting Data In

Why my truncate configuration on my universal forwarder is not working?

qiye
Explorer

Hi All,

I setup one universal forwarder on my windows server and forward the logs to my linux splunk instance, and the events are truncated to 10000.

I tried set the truncate settings in my forwarder, and it doesn’t work at all, here’s my configuration:

E:\services\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\local\inputs.conf

[monitor://E:\logs]

**TRUNCATE = 0**

disabled = false

Can someone help that?

1 Solution

gfuente
Motivator

You need to put the TRUNCATE setting in the indexer, in a props.conf file

something like:

[yoursourcetype]
TRUNCATE = 0 

Restart the indexer after changing this setting

Regards

View solution in original post

gfuente
Motivator

You need to put the TRUNCATE setting in the indexer, in a props.conf file

something like:

[yoursourcetype]
TRUNCATE = 0 

Restart the indexer after changing this setting

Regards

qiye
Explorer

Thanks all. We resolved the issue with heavy forwarder instead of universal forwarder. The TRUNCATE setting doesn't work in universal forwarder not matter i put it into the props.conf or input.conf.

Final solution:
1. added below configuration in indexer's props.conf.
[yoursourcetype]
TRUNCATE = 0

  1. Setup one heavy forwarder (install full splunk and change it's license to forwarder).

  2. Added below configuration in heavy forwarder's etc\
    system\local\props.conf
    [yoursourcetype]
    TRUNCATE = 0

  3. it works as excepted.

somesoni2
SplunkTrust
SplunkTrust

This attribute is applicable for props.conf only (on indexer). Inputs.conf (on universal forwarder) need not be changed.

0 Karma

qiye
Explorer

Thanks. I will try. Besides, do i need modify the inputs.conf and props.conf both?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...