Splunk Enterprise

TCP/UDP truncates files at 10K

tmontney
Builder

Like many questions I've seen here, anything sent via TCP/UDP is being cut off after 10K.

I have a simple app deployed to clients. My inputs.conf has a stanza for a script, and it's to run a program that will (at the end) send JSON data back via TCP. I figured this was better than monitoring an output file. This file is between 40 to 50K. Per suggestions, I created a props.conf in my ./myapp/local.

[tcp://515]
truncate = 100000

Or perhaps I've understood how to implement props.conf correctly. I restarted the Splunk service after making this change, sent the data again, and it's cut off at 10K.

Tags (1)
0 Karma

koshyk
Super Champion

how much increased to? Please note 10K is "bytes" and not characters.
Try putting it as "0" and try

Also I believe if it is json, don't use just bytes, but use something like..

[tcp://515]
 KV_MODE = json
 LINE_BREAKER = "(^){"
 NO_BINARY_CHECK = 1
 TRUNCATE = 0
 SHOULD_LINEMERGE = false
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...