topic Re: Changing message size globally in Splunk in Getting Data In

Changing message size globally in Splunk

brent_weaver — Tue, 05 Sep 2017 19:02:32 GMT

I have a few sourcetypes that are exceeding the message size limit of 10K and I would like to set this to 32767 for all sourcetypes. I know how to do it for an individual sourcetype, how can I do it globally? Can I put it in etc/system/local/props.conf in the default section?

Re: Changing message size globally in Splunk

s2_splunk — Tue, 05 Sep 2017 19:49:09 GMT

Yes, that would be the proper approach based on conf file precedence

However, changing it globally will affect memory utilization since buffer allocation will use the higher value for everything, so I would probably raise the limit for those sourcetypes that need it. It also adds a level of 'documentation' to your sourcetype configuration that maybe helpful in understanding the input's characteristics.

Re: Changing message size globally in Splunk

brent_weaver — Wed, 06 Sep 2017 00:22:48 GMT

Thank you for the great info... Totally makes sense. I will do it for the sourcetypes that need it. Do I need to consider the the UF config for those ST's affected? Do I need to do the same thing on the UF side?

Re: Changing message size globally in Splunk

s2_splunk — Wed, 06 Sep 2017 02:42:56 GMT

Nope, only relevant where parsing happens, i.e. Heavy Forwarder (if used) or indexer.