https://community.splunk.com/t5/Getting-Data-In/What-is-the-reason-for-an-incomplete-data-HTTP-event-collector/m-p/624853#M107407 <P>HI do you see any&nbsp;<STRONG>“Content-Length of XXXXX too large (maximum is 1000000) “ </STRONG>errors?</P><P>Maybe you will find these links useful:</P><P><A href="https://www.splunk.com/en_us/blog/tips-and-tricks/handling-http-event-collector-hec-content-length-too-large-errors-without-pulling-your-hair-out.html?locale=en_us" target="_blank">https://www.splunk.com/en_us/blog/tips-and-tricks/handling-http-event-collector-hec-content-length-too-large-errors-without-pulling-your-hair-out.html?locale=en_us</A></P><P><A href="https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/TroubleshootHTTPEventCollector" target="_blank">https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/TroubleshootHTTPEventCollector</A></P><P>&nbsp;</P> Tue, 20 Dec 2022 14:01:47 GMT wmazur-splunk 2022-12-20T14:01:47Z https://community.splunk.com/t5/Getting-Data-In/What-is-the-reason-for-an-incomplete-data-HTTP-event-collector/m-p/624083#M107339 <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="server_conf HF.png" style="width: 437px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/22973i27FB0378821D2DB0/image-size/large?v=v2&amp;px=999" role="button" title="server_conf HF.png" alt="server_conf HF.png" /><span class="lia-inline-image-caption" onclick="event.preventDefault();">server_conf HF.png</span></span></P> <P>Hello dear community</P> <P>Could you please tell me how to find the reason.</P> <P>I am using HTTP Event Collector for Kubernetes. I have a configured data token coming into the index. But the team I'm helping assures me that the data in the index gets lost and it's not all sent to Splunk. Maybe someone has already encountered such a problem and perhaps the limits for data transfer are to blame? but I don't know how to check it. I tried to do a search in _internal on the index for which there are complaints. But perhaps you have a better way. Also, an application is installed on my HF, where all the indices and tokens for them are registered there, I found a file with limits. How can I see how much data is coming in for a token and if the values ​​are stuck?</P> Tue, 13 Dec 2022 15:11:06 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-the-reason-for-an-incomplete-data-HTTP-event-collector/m-p/624083#M107339 igor04653 2022-12-13T15:11:06Z https://community.splunk.com/t5/Getting-Data-In/What-is-the-reason-for-an-incomplete-data-HTTP-event-collector/m-p/624853#M107407 <P>HI do you see any&nbsp;<STRONG>“Content-Length of XXXXX too large (maximum is 1000000) “ </STRONG>errors?</P><P>Maybe you will find these links useful:</P><P><A href="https://www.splunk.com/en_us/blog/tips-and-tricks/handling-http-event-collector-hec-content-length-too-large-errors-without-pulling-your-hair-out.html?locale=en_us" target="_blank">https://www.splunk.com/en_us/blog/tips-and-tricks/handling-http-event-collector-hec-content-length-too-large-errors-without-pulling-your-hair-out.html?locale=en_us</A></P><P><A href="https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/TroubleshootHTTPEventCollector" target="_blank">https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/TroubleshootHTTPEventCollector</A></P><P>&nbsp;</P> Tue, 20 Dec 2022 14:01:47 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-the-reason-for-an-incomplete-data-HTTP-event-collector/m-p/624853#M107407 wmazur-splunk 2022-12-20T14:01:47Z