topic Re: Splunk Entreprise Max Upload issue in Splunk Enterprise

Splunk Entreprise Max Upload issue

fedayn05 — Mon, 20 Oct 2025 10:49:15 GMT

Hello Folks,

I am currently using Splunk Entreprise10.0.0 on ubuntu , I am trying to upload an app manually but it told me that the max upload is 512 Mb , i changed the value in web.conf to from 500 to 2000 , restart the service.

I run : /opt/splunk/bin/splunk btool web list settings | grep max_upload , and it returns max_upload_size = 2000 .

But when i try uploading again , it gives me the same error. Any idea plese.

Thank you in advance for your help

Re: Splunk Entreprise Max Upload issue

livehybrid — Mon, 20 Oct 2025 11:18:28 GMT

Hi @fedayn05

Can you please confirm the size of the app your are trying to install? Its definitely smaller than 2000mb right?

What is the specific error returned? Is there also a more detailed error in $SPLUNK_HOME/var/log/splunk/splunkd.log ?

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Splunk Entreprise Max Upload issue

fedayn05 — Mon, 20 Oct 2025 12:56:00 GMT

Hello,

Thaank you for your response , the size of the app is around 800mb , i just set 2000mb as a choice , the error was " Upload failed: Package is too large, must be less than 512 MB",

I tried to see if an error is produced on splnkd.log , but nothing got out of it .

Thank you

Re: Splunk Entreprise Max Upload issue

vjdev — Mon, 20 Oct 2025 15:26:02 GMT

Hello,

1. Verifiy the configuration web.conf

[settings]
max_upload_size = 2000

2. Restart Splunk

3. Verify configuration in the memory

/opt/splunk/bin/splunk show config web | grep max_upload_size

4. Try upload the file Now.

Thank you!

Re: Splunk Entreprise Max Upload issue

fedayn05 — Mon, 20 Oct 2025 16:07:31 GMT

Hello vjdev,

1- The web.conf returns : max_upload_size = 2000

2- i did restart splunk (both via CLI and GUI)

3- i run this /opt/splunk/bin/splunk show config web | grep max_upload_size and it returns max_upload_size = 2000

So i really do not know if this is a bug or another config somewhere is overatting the web.conf file

Thank you for your response

Re: Splunk Entreprise Max Upload issue

PickleRick — Mon, 20 Oct 2025 16:30:19 GMT

What is your environment? Are you sure you're changing the settings on the right component? (yes I know it's a very basic question but sometimes we miss the obvious)

Re: Splunk Entreprise Max Upload issue

livehybrid — Mon, 20 Oct 2025 19:17:39 GMT

Hi @fedayn05

This is very odd, if you've run

/opt/splunk/bin/splunk btool web list settings | grep max_upload_size

then it would confirm that it the max_upload_size is in the correct stanza (settings) in the correct file (web.conf) and its not commented out or mis-spelt.

Just to check - its just plain-old 2000 right? not 2000MB or 2000mb

Can I also confirm that you are running Splunk on Linux?

Which version are you on?

Im suspecting there may be an issue with 10.0.x here but trying to rule things out. Also - the default is 500 not 512 so makes me wonder if there is another setting somewhere??

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Splunk Entreprise Max Upload issue

livehybrid — Mon, 20 Oct 2025 19:57:23 GMT

Okay @fedayn05

Ive been down a rabbit hole on this one and found that the 512mb limit is hard-coded in the UI component in >= 10.0.0

I was testing uploading of ES 8.x on a local Splunk 10.0.1 install and found the same issue you had which led me to this.

Are you also trying to install ES8? I discovered SPL-282727 which relates to ES8 not being installable via the Web UI in Splunk 10.x (See https://help.splunk.com/en/splunk-enterprise-security-8/release-notes-and-resources/8.2/splunk-enterprise-security-release-notes/known-issues ) and https://help.splunk.com/en/splunk-enterprise-security-8/release-notes-and-resources/8.2/splunk-enterprise-security-release-notes/release-notes-for-splunk-enterprise-security also states

You cannot upload Splunk Enterprise Security 8.x on an on-premises deployment of Splunk Enterprise 10.x using the UI. You must install Splunk Enterprise Security 8.x using the command line.

So the bottom line is that this is a bug - whilst the above is specific to Enterprise Security, even if you arent trying to install ES8 I believe you will be hitting the same issue.

Hopefully this will be resolved soon but in the meantime please install your app a via the CLI.

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Splunk Entreprise Max Upload issue

fedayn05 — Mon, 27 Oct 2025 08:34:34 GMT

Hello,

Thank you so much for your response and efforts, this really helped me as i thought the issue ewas on my side but it was a bug after all.

I am planning to go the 9.4 version, do you have any guide by chance on howe to switch from Splunk Etreprise 10.x to 9.4.

Thank you for you response once again .

Re: Splunk Entreprise Max Upload issue

PickleRick — Mon, 27 Oct 2025 09:19:39 GMT

There is no official/supported way of downgrading your Splunk Enterprise environment.

You _might_ get away with doing a backup of your runtime data and local configs, razing your environment completely, installing lower version and restoring the backup but it is a relatively risky process (and of course if you have a distributed environment you'd have to do the downgrades in the opposite order from your upgrades). But noone will guarantee that it will not destroy your setup. Especially since you want to downgrade over big version.

Re: Splunk Entreprise Max Upload issue

fedayn05 — Mon, 27 Oct 2025 12:17:39 GMT

Hello,

Can I then deploy another VM , install the intended Splunk version , then detach the disk from the old Splunk and attach it to the new one.

May this work ?

Re: Splunk Entreprise Max Upload issue

PickleRick — Mon, 27 Oct 2025 12:19:48 GMT

Depends on what you mean by "disk". Data? Config? Generally this boils more or less to "install and restore config/data" and will have more or less the same result.