are you asking size and retention of sourcetype or index?
One index has data size / time to retention bucket roll over policies. It can have multiple source / sourcetypes, that does not matter.
But I am thinking that perhaps you are asking for something else?
I was asking about sourcetype. How to know the size allocated to sourcetype. Also what is the limit on the size data we pass in a transaction? we see that transaction with 1mB data is not getting logged in
To @Sukisen1981's point, sourcetype has no size associated with it. You define the size of an index. Sourcetype is simply a way of categorizing your data.
A real-life transaction may contain multiple Splunk "events" (based on how the sourcetype is breaking events in your log file. The default size of an event is 10,000 bytes after which an event will be truncated (not dropped fully, just first 10,000 bytes are retained). You can change this by setting up TRUNCATE attribute for your sourcetype. You can refer to following Splunk documentation for information on various sourcetype level attributes: https://docs.splunk.com/Documentation/Splunk/latest/admin/Propsconf#Line_breaking
