topic Re: Is there character limits in previous Splunk version? in Splunk Enterprise

Is there character limits in previous Splunk version?

xRusty9 — Mon, 14 Nov 2022 06:40:00 GMT

Hi,

May I check whether is there character limits when sending data to Splunk? Is there 10000 limit on Splunk Enterprise version 8.0.5?

Thanks!

Re: Is there character limits in previous Splunk version?

SanjayReddy — Mon, 14 Nov 2022 07:05:16 GMT

Hi @xRusty9

Defult is 10k , for all for splunk versions, this value present in $Splunk_Home/etc/system/default/props.conf

if you wante to increase the limit please update in local directory

TRUNCATE = <non-negative integer>
* The default maximum line length, in bytes.
* Although this is in bytes, line length is rounded down when this would
  otherwise land mid-character for multi-byte characters.
* Set to 0 if you never want truncation (very long lines are, however, often
  a sign of garbage data).
* Default: 10000

this can be based on source or sourcetype or host in props.conf
ex:

[host::small_events]
TRUNCATE = 256

---
If this reply helps you, an upvote/Karma would be appreciated.

Re: Is there character limits in previous Splunk version?

xRusty9 — Mon, 14 Nov 2022 07:14:44 GMT

Hi, thanks for the reply. I am using the latest version(9.0.1) and the older version(8.0.5), and 9.0.1 able to send more than 10k of data without changing the configuration. Whereas 8.0.5 truncate around 10k.

Re: Is there character limits in previous Splunk version?

SanjayReddy — Mon, 14 Nov 2022 08:31:05 GMT

Hi @xRusty9

Can you following command from splunk bin directory on both 9.0.1 and 8.0.5 servers to check any local configuration that updated?

./splunk btool props list --debug | grep -i TRUNCATE

Re: Is there character limits in previous Splunk version?

xRusty9 — Tue, 15 Nov 2022 05:37:08 GMT

I do see that props.conf have a few TRUNCATE setting. Do I change all of them so that longer message can be loaded in Splunk? or I change the default, splunkd, and KVstore will do?

Re: Is there character limits in previous Splunk version?

xRusty9 — Tue, 15 Nov 2022 08:47:17 GMT

Hi @SanjayReddy ,

I do see that props.conf have a few TRUNCATE setting. Do I change all of them so that longer message can be loaded in Splunk? or I change the default, splunkd, and KVstore will do?

Just to update:

I tried to add the following under the $Splunk_Home/etc/system/default/props.conf, the truncate didnt happen in version 9.0.5.

[host::127.0.0.1:8088]
TRUNCATE = 256

My data came in via HEC.

Re: Is there character limits in previous Splunk version?

SanjayReddy — Sun, 20 Nov 2022 07:03:06 GMT

Hi @xRusty9

remove port from header and save it

check if that is working?