Knowledge Management

What is the maximum length of a tag and an event?

atant
Splunk Employee
Splunk Employee

What is the maximum length of a tag?
What is the maximum length of an event?

Tags (2)
0 Karma

mayurr98
Super Champion

The default event size limit is 10000 characters. You can override this in props.conf as follows

 [yoursourcetypehere]
 TRUNCATE = 0
 MAX_EVENTS = 10000

Setting TRUNCATE to zero means "no truncation". MAX_EVENTS actually sets "the maximum number of lines per event." MAX_EVENTS only applies to multi-line events, but the default is 256 lines. If you are dealing with multi-line events, you may want to set this to a much larger value.

You can put the props.conf file under an application, if it is application-specific, or under /etc/system/local

0 Karma

davpx
Communicator

The maximum length of an event is governed by your TRUNCATE setting in props.conf (default is 10,000 bytes) and can also be manipulated by other parameters.

The maximum length of a tag is not documented as far as I can tell but a quick test tells me its 1024 characters.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...