Getting Data In

Changing message size globally in Splunk

brent_weaver
Builder

I have a few sourcetypes that are exceeding the message size limit of 10K and I would like to set this to 32767 for all sourcetypes. I know how to do it for an individual sourcetype, how can I do it globally? Can I put it in etc/system/local/props.conf in the default section?

0 Karma
1 Solution

s2_splunk
Splunk Employee
Splunk Employee

Yes, that would be the proper approach based on conf file precedence

However, changing it globally will affect memory utilization since buffer allocation will use the higher value for everything, so I would probably raise the limit for those sourcetypes that need it. It also adds a level of 'documentation' to your sourcetype configuration that maybe helpful in understanding the input's characteristics.

View solution in original post

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Yes, that would be the proper approach based on conf file precedence

However, changing it globally will affect memory utilization since buffer allocation will use the higher value for everything, so I would probably raise the limit for those sourcetypes that need it. It also adds a level of 'documentation' to your sourcetype configuration that maybe helpful in understanding the input's characteristics.

0 Karma

brent_weaver
Builder

Thank you for the great info... Totally makes sense. I will do it for the sourcetypes that need it. Do I need to consider the the UF config for those ST's affected? Do I need to do the same thing on the UF side?

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Nope, only relevant where parsing happens, i.e. Heavy Forwarder (if used) or indexer.

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...