Getting Data In

Changing message size globally in Splunk

brent_weaver
Builder

I have a few sourcetypes that are exceeding the message size limit of 10K and I would like to set this to 32767 for all sourcetypes. I know how to do it for an individual sourcetype, how can I do it globally? Can I put it in etc/system/local/props.conf in the default section?

0 Karma
1 Solution

s2_splunk
Splunk Employee
Splunk Employee

Yes, that would be the proper approach based on conf file precedence

However, changing it globally will affect memory utilization since buffer allocation will use the higher value for everything, so I would probably raise the limit for those sourcetypes that need it. It also adds a level of 'documentation' to your sourcetype configuration that maybe helpful in understanding the input's characteristics.

View solution in original post

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Yes, that would be the proper approach based on conf file precedence

However, changing it globally will affect memory utilization since buffer allocation will use the higher value for everything, so I would probably raise the limit for those sourcetypes that need it. It also adds a level of 'documentation' to your sourcetype configuration that maybe helpful in understanding the input's characteristics.

0 Karma

brent_weaver
Builder

Thank you for the great info... Totally makes sense. I will do it for the sourcetypes that need it. Do I need to consider the the UF config for those ST's affected? Do I need to do the same thing on the UF side?

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Nope, only relevant where parsing happens, i.e. Heavy Forwarder (if used) or indexer.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...