Getting Data In

Syslog data from UDP. Maximum message size?

eject
Engager

What's maximum message size which splunk's syslog will accept via UDP? How I can increase it?

Tags (3)

BenAveling
Path Finder

This sounds like a UDP problem, not a splunk problem.

For me, anything up to 65507 bytes is received (and truncated to 10000 bytes). Anything longer just gets lost.

If you have perl, maybe try sending to the following script and seeing what happens:

my $usage = qq{Usage:
  perl udp_server.pl port
};

use strict;

use IO::Socket;

my $port=shift or die "port not specified\n\n$usage";

my $response = IO::Socket::INET->new(Proto=>"udp",LocalPort=>$port)
  or die "Can't make UDP server: $@";

my $message=0;

while(1){
  print "Listening on $port...\n";
  my ($datagram,$flags);
  $response->recv($datagram,100000,$flags) or warn "recv failed: $!\n";
  print "Got message ",++$message," from ", $response->peerhost,", flags ",$flags || "none",": $datagram\n", "length: ",length $datagram,"\n";
}

hazekamp
Builder

Splunk uses the TRUNCATE setting in props.conf to determine maximum message size. By default this is set to 10000 bytes.

## props.conf.spec
TRUNCATE = <non-negative integer>
* Change the default maximum line length (in bytes).
* Although this is in bytes, line length is rounded down when this would
  otherwise land mid-character for multi-byte characters.
* Set to 0 if you never want truncation (very long lines are, however, often a sign of
  garbage data).
* Defaults to 10000 bytes.

dwaddle
SplunkTrust
SplunkTrust

I might suggest trying to run strace on splunk's calls to recv(). You'll want to make sure that the buffer size passed to recv() is big enough to receive the whole datagram in one call.

0 Karma

eject
Engager

I've set TRUNCATE = 0 in C:\Program Files\Splunk\etc\system\default\props.conf and restarted Splunk. tried to send 2600 bytes and it don't displayed :(.

With wireshark I see that that messages reached server.

All messages which are smaller than 1900 bytes displays just fine. How can I debug this problem ?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...