Where can I change the maximum of the event length to prevent that events are truncated at index-time

rrovers — Wed, 05 Jun 2024 06:25:19 GMT

Events longer than 15.000 characters are truncated now.

We wonder if there is a limit for this (so for example in the configuration the maximum event length can't be set to a number higher than 50.000).
Where and how can we change this limit for a certain index.

Re: Where can I change the maximum of the event length to prevent that events are truncated at index-time

tej57 — Wed, 05 Jun 2024 08:45:38 GMT

You can update the truncate limit on the first Splunk Enterprise instance that the data encounters. If your data flow is UF -> IUF -> Indexers or UF -> Indexers, in that case you need to place the following sourcetype on the indexers. And if your data flow is UF -> IHF -> Indexers, in that case you'll need to place the sourcetype configuration on the IHF. Here, IUF and IHF refer to Intermediate Universal Forwarder and Intermediate Heavy Forwarder respectively.

[<<sourcetype>>] TRUNCATE = <<max_length_of_event>>

Also, you can set TRUNCATE to any value you wish.

---
Thanks,
Tejas.

topic Where can I change the maximum of the event length to prevent that events are truncated at index-time in Splunk Search

Where can I change the maximum of the event length to prevent that events are truncated at index-time

Re: Where can I change the maximum of the event length to prevent that events are truncated at index-time