Syslog Universal Forwarder truncated at 1024 bytes

someyoungfella — Mon, 10 Dec 2012 14:25:36 GMT

Hi there,

I'm using a Splunk UF to monitor a Windows folder and syslog the events to a remote server where they are collected and written to Hadoop.

From reading previous questions here, I understand that the syslog universal forwarder is RFC 3164 compliant. That is, events have a maximum length of 1024 bytes, after which they are truncated. I was wondering if there are plans to change that (perhaps by implementing RFC 5424?). If not, could anyone suggest an alternative?

Thanks in advance.

Re: Syslog Universal Forwarder truncated at 1024 bytes

SK110176 — Thu, 02 Jul 2015 16:32:01 GMT

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Outputsconf

----Syslog output----

maxEventSize =
* If specified, sets the maximum size of an event that splunk will transmit.
* All events excedding this size will be truncated.
* Defaults to 1024 bytes.

topic Syslog Universal Forwarder truncated at 1024 bytes in Getting Data In

Syslog Universal Forwarder truncated at 1024 bytes

Re: Syslog Universal Forwarder truncated at 1024 bytes

----Syslog output----