topic event size limit in Getting Data In

event size limit

sbsbb — Mon, 26 Nov 2012 18:15:30 GMT

Is there any limit from the event-size ?

My events are truncated, one event is about 3Mo text. Is there a possibility to increase the event size in the config ?

Re: event size limit

lguinn2 — Mon, 26 Nov 2012 19:00:33 GMT

The default event size limit is 10000 characters. You can override this in props.conf as follows

[yoursourcetypehere]
TRUNCATE = 0
MAX_EVENTS = 10000

Setting TRUNCATE to zero means "no truncation". MAX_EVENTS actually sets "the maximum number of lines per event." MAX_EVENTS only applies to multi-line events, but the default is 256 lines. If you are dealing with multi-line events, you may want to set this to a much larger value.

You can put the props.conf file under an application, if it is application-specific, or under /etc/system/local

Re: event size limit

mufthmu — Thu, 12 Dec 2019 23:19:53 GMT

hi @lguinn2 , I updated the props.conf in my indexer and forwarder but my data still get truncated to 100 KB.
According to this answer https://answers.splunk.com/answers/155691/why-are-larger-events-are-truncated-10000-bytes.html .. I also need to update the Heavy Forwarder's props.conf file. Do you know how to find out if my data flows thru the HWF before getting into the indexer?