topic Re: Where do I change the maximum Message body length? in Getting Data In

Where do I change the maximum Message body length?

gregbo — Fri, 17 Sep 2021 08:16:10 GMT

I'm trying to get a large text file ingested using the HEC. In my searches for the data, I see events that say "Message body length 3169085 greater than maximum allowed (2097152). Where can I change that maximum? I can't find any setting that says "Message body length", and I can't find any setting set to 2097152

Re: Where do I change the maximum Message body length?

kamlesh_vaghela — Fri, 17 Sep 2021 08:25:36 GMT

@gregbo

Check: https://www.splunk.com/en_us/blog/tips-and-tricks/handling-http-event-collector-hec-content-length-too-large-errors-without-pulling-your-hair-out.html

Re: Where do I change the maximum Message body length?

gregbo — Mon, 20 Sep 2021 10:06:10 GMT

Thanks for the info, I tried the solution in that article and it made to difference. My error message is different than the one in that article.

Re: Where do I change the maximum Message body length?

Roy_9 — Wed, 22 Sep 2021 16:15:19 GMT

Keep the truncate limit to 0 on the sourcetype, hopefully it should fix the problem.