https://community.splunk.com/t5/Getting-Data-In/MAX-EVENTS-in-props-conf-not-working/m-p/417606#M73696 <P>These are Indexer configurations, not UF configurations. They need to be deployed to your Indexer tier inside of Splunk Cloud. You will probably need to open a support ticket to get that done. They are in the wrong place.</P> Mon, 02 Jul 2018 14:13:06 GMT woodcock 2018-07-02T14:13:06Z https://community.splunk.com/t5/Getting-Data-In/MAX-EVENTS-in-props-conf-not-working/m-p/417605#M73695 <P>Hi everyone,</P> <P>We have the following Splunk configuration:</P> <UL> <LI>Splunk Cloud instance (managed)</LI> <LI>Universal Forwarder</LI> <LI>Monitoring log</LI> </UL> <P>We need to index event logs with more than 256 lines.<BR /> props.conf (located at: SplunkUniversalForwarder\etc\system\local) has the following configuration:</P> <P>[esb]<BR /> disabled = false<BR /> TRUNCATE = 0<BR /> LINE_BREAKER = ^.{4}-.{2}-.{2}\s.*<BR /> SHOULD_LINEMERGE = true<BR /> MAX_EVENTS = 100000</P> <P>At search time, events appear truncated at max of 257 lines so, I suppose, that MAX_EVENTS props.conf isn't working.</P> <P>How can i solve this issue?</P> <P>Thanks</P> Tue, 29 Sep 2020 20:15:17 GMT https://community.splunk.com/t5/Getting-Data-In/MAX-EVENTS-in-props-conf-not-working/m-p/417605#M73695 fcologno 2020-09-29T20:15:17Z https://community.splunk.com/t5/Getting-Data-In/MAX-EVENTS-in-props-conf-not-working/m-p/417606#M73696 <P>These are Indexer configurations, not UF configurations. They need to be deployed to your Indexer tier inside of Splunk Cloud. You will probably need to open a support ticket to get that done. They are in the wrong place.</P> Mon, 02 Jul 2018 14:13:06 GMT https://community.splunk.com/t5/Getting-Data-In/MAX-EVENTS-in-props-conf-not-working/m-p/417606#M73696 woodcock 2018-07-02T14:13:06Z