Deployment Architecture

Splunk DB connect: How to change maximum size per event

sj0man
Engager

Environments: Windows Server 2008 R2, Splunk 6.2.3, DB connect 1.2, JRE8, MSSQL

There are some events of more than 10 KB.
If they are indexing from command line interface, then it's successful.
splunk add oneshot file -index my_index -sourcetype my_sourcetype -auth id:pwd
And I check the event from dbquery, it's no problem.

BTW, DB connect 1.2 got truncated event until 10 KB.
I changed conf files like below.
Still I could not solve the problem.

$SPLUNK_HOME/etc/apps/search/local/props.conf
[my_sourcetype]
TRUNCATE = 100000 
## 10 times than default

$SPLUNK_HOME/etc/apps/dbx/local/java.conf
[dbx]
query.stream.limit = 100000
Tags (1)
0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

I could swear that is a SQL Server limitation, but SQL 2008 was the new kid on the block last time I did this as $dayjob and I'm not seeing anything obvious on the web.

What exactly are you doing from DB Connect that's getting truncated? Indexing? a dbxquery? a dblookup?

0 Karma

sj0man
Engager

I want to index data from original source, and It's ok under the 10 KB.
I'm collecting data like below. SQL version is 11.0 from Cloud DB.

[1] Device (Original Source, JSON format) => [2] Cloud DB (MS-Azure) => [3] DB-connect 1.2 => [4] Splunk 6.2.3

[2] data fully support more than 10 KB. (OK)
[4] splunk indexes more than 10 KB from file. (OK)
[2]-[3]-[4] has the problem which got truncated.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...