https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-change-the-MaxValueSize-for-HEC/m-p/435280#M75948 <P>Getting a ton of this, and it's making Kafka Connect really grumpy. Any way to increase MaxValueSize?</P> <P>06-19-2019 17:16:54.627 -0400 ERROR HttpInputDataHandler - Parsing error : While expecting event's raw text: String value too long. valueSize=5247864, maxValueSize=5242880, totalRequestSize=6963917<BR /> 06-19-2019 17:17:14.622 -0400 ERROR HttpInputDataHandler - Parsing error : While expecting event's raw text: String value too long. valueSize=5247864, maxValueSize=5242880, totalRequestSize=6963917<BR /> 06-19-2019 17:17:34.629 -0400 ERROR HttpInputDataHandler - Parsing error : While expecting event's raw text: String value too long. valueSize=5247864, maxValueSize=5242880, totalRequestSize=6963917<BR /> 06-19-2019 17:17:54.624 -0400 ERROR HttpInputDataHandler - Parsing error : While expecting event's raw text: String value too long. valueSize=5247864, maxValueSize=5242880, totalRequestSize=6963917<BR /> 06-19-2019 17:18:14.628 -0400 ERROR HttpInputDataHandler - Parsing error : While expecting event's raw text: String value too long. valueSize=5247864, maxValueSize=5242880, totalRequestSize=6963917<BR /> 06-19-2019 17:18:34.624 -0400 ERROR HttpInputDataHandler - Parsing error : While expecting event's raw text: String value too long. valueSize=5247864, maxValueSize=5242880, totalRequestSize=6963917<BR /> 06-19-2019 17:18:54.623 -0400 ERROR HttpInputDataHandler - Parsing error : While expecting event's raw text: String value too long. valueSize=5247864, maxValueSize=5242880, totalRequestSize=6963917<BR /> 06-19-2019 17:19:14.626 -0400 ERROR HttpInputDataHandler - Parsing error : While expecting event's raw text: String value too long. valueSize=5247864, maxValueSize=5242880, totalRequestSize=6963917<BR /> 06-19-2019 17:19:34.619 -0400 ERROR HttpInputDataHandler - Parsing error : While expecting event's raw text: String value too long. valueSize=5247864, maxValueSize=5242880, totalRequestSize=6963917</P> Wed, 19 Jun 2019 21:21:39 GMT adammike 2019-06-19T21:21:39Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-change-the-MaxValueSize-for-HEC/m-p/435280#M75948 <P>Getting a ton of this, and it's making Kafka Connect really grumpy. Any way to increase MaxValueSize?</P> <P>06-19-2019 17:16:54.627 -0400 ERROR HttpInputDataHandler - Parsing error : While expecting event's raw text: String value too long. valueSize=5247864, maxValueSize=5242880, totalRequestSize=6963917<BR /> 06-19-2019 17:17:14.622 -0400 ERROR HttpInputDataHandler - Parsing error : While expecting event's raw text: String value too long. valueSize=5247864, maxValueSize=5242880, totalRequestSize=6963917<BR /> 06-19-2019 17:17:34.629 -0400 ERROR HttpInputDataHandler - Parsing error : While expecting event's raw text: String value too long. valueSize=5247864, maxValueSize=5242880, totalRequestSize=6963917<BR /> 06-19-2019 17:17:54.624 -0400 ERROR HttpInputDataHandler - Parsing error : While expecting event's raw text: String value too long. valueSize=5247864, maxValueSize=5242880, totalRequestSize=6963917<BR /> 06-19-2019 17:18:14.628 -0400 ERROR HttpInputDataHandler - Parsing error : While expecting event's raw text: String value too long. valueSize=5247864, maxValueSize=5242880, totalRequestSize=6963917<BR /> 06-19-2019 17:18:34.624 -0400 ERROR HttpInputDataHandler - Parsing error : While expecting event's raw text: String value too long. valueSize=5247864, maxValueSize=5242880, totalRequestSize=6963917<BR /> 06-19-2019 17:18:54.623 -0400 ERROR HttpInputDataHandler - Parsing error : While expecting event's raw text: String value too long. valueSize=5247864, maxValueSize=5242880, totalRequestSize=6963917<BR /> 06-19-2019 17:19:14.626 -0400 ERROR HttpInputDataHandler - Parsing error : While expecting event's raw text: String value too long. valueSize=5247864, maxValueSize=5242880, totalRequestSize=6963917<BR /> 06-19-2019 17:19:34.619 -0400 ERROR HttpInputDataHandler - Parsing error : While expecting event's raw text: String value too long. valueSize=5247864, maxValueSize=5242880, totalRequestSize=6963917</P> Wed, 19 Jun 2019 21:21:39 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-change-the-MaxValueSize-for-HEC/m-p/435280#M75948 adammike 2019-06-19T21:21:39Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-change-the-MaxValueSize-for-HEC/m-p/435281#M75949 <P>One of the engineers at Splunk was able to help me out. This resolved the issue for me.</P> <PRE><CODE>[http] disabled = 0 maxEventSize = 15728640 </CODE></PRE> <P>Here is the email I got that explains it:</P> <P>Hello Mike,<BR /> To address the issue referenced below, a new global setting called maxEventSize under [http] stanza in inputs.conf has been introduced to allow customers to configure the expected maximum size of HEC event as part of these releases 7.0.5, 7.0.3.7, 7.1.3, and later.</P> <P>A workaround for this issue is to have 6.x based HWFs parse the HEC events before forwarding to indexers.</P> <P>Please let me know if you have any additional question.</P> Thu, 20 Jun 2019 19:51:17 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-change-the-MaxValueSize-for-HEC/m-p/435281#M75949 adammike 2019-06-20T19:51:17Z