Getting Data In

Is there a character limit for sourcetypes?

wapireso
Explorer

Hi everyone,

I have doubts about character limits to sourcetype.
I'll need to get a sourcetype name using transforms/meta, but I have very large fields, greater than 50 characters. This will be a problem?

Thanks

0 Karma
1 Solution

somesoni2
Revered Legend

If you're referring to the length of sourcetype field, then officially there is no character limit. I've created/seen sourcetypes names with character length of 100+ without any issues. (other than it's becomes inconvenient to write queries/field extraction using lengthy sourcetype names).

View solution in original post

somesoni2
Revered Legend

If you're referring to the length of sourcetype field, then officially there is no character limit. I've created/seen sourcetypes names with character length of 100+ without any issues. (other than it's becomes inconvenient to write queries/field extraction using lengthy sourcetype names).

Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...