topic Re: Indexed extraction is not working if json HEC  event payload is more than 512KB in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Why-is-indexed-extraction-not-working-if-json-HEC-event-payload/m-p/640594#M109333 <P><SPAN>It's a known issue for HEC that for indexed extraction `maxEventSize`&nbsp; is not honored hence max json payload is 512KB.<BR />Splunk 9.0 and above issue is fixed.</SPAN></P> Wed, 19 Apr 2023 13:07:02 GMT hrawat 2023-04-19T13:07:02Z Why is indexed extraction not working if json HEC  event payload is more than 512KB? https://community.splunk.com/t5/Getting-Data-In/Why-is-indexed-extraction-not-working-if-json-HEC-event-payload/m-p/640592#M109332 <DIV class=""> <DIV class="">With INDEXED_EXTRACTIONS=JSON,&nbsp;indexed extraction is not working if json HEC&nbsp; event payload is more than 512KB.</DIV> <DIV class="">&nbsp;</DIV> </DIV> Thu, 20 Apr 2023 17:04:15 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-indexed-extraction-not-working-if-json-HEC-event-payload/m-p/640592#M109332 hrawat 2023-04-20T17:04:15Z Re: Indexed extraction is not working if json HEC  event payload is more than 512KB https://community.splunk.com/t5/Getting-Data-In/Why-is-indexed-extraction-not-working-if-json-HEC-event-payload/m-p/640594#M109333 <P><SPAN>It's a known issue for HEC that for indexed extraction `maxEventSize`&nbsp; is not honored hence max json payload is 512KB.<BR />Splunk 9.0 and above issue is fixed.</SPAN></P> Wed, 19 Apr 2023 13:07:02 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-indexed-extraction-not-working-if-json-HEC-event-payload/m-p/640594#M109333 hrawat 2023-04-19T13:07:02Z