Environments: Windows Server 2008 R2, Splunk 6.2.3, DB connect 1.2, JRE8, MSSQL
There are some events of more than 10 KB.
If they are indexing from command line interface, then it's successful.
splunk add oneshot file -index my_index -sourcetype my_sourcetype -auth id:pwd
And I check the event from dbquery, it's no problem.
BTW, DB connect 1.2 got truncated event until 10 KB.
I changed conf files like below.
Still I could not solve the problem.
$SPLUNK_HOME/etc/apps/search/local/props.conf
[my_sourcetype]
TRUNCATE = 100000
## 10 times than default
$SPLUNK_HOME/etc/apps/dbx/local/java.conf
[dbx]
query.stream.limit = 100000
... View more