Getting Data In

Changing message size globally in Splunk

brent_weaver
Builder

I have a few sourcetypes that are exceeding the message size limit of 10K and I would like to set this to 32767 for all sourcetypes. I know how to do it for an individual sourcetype, how can I do it globally? Can I put it in etc/system/local/props.conf in the default section?

0 Karma
1 Solution

s2_splunk
Splunk Employee
Splunk Employee

Yes, that would be the proper approach based on conf file precedence

However, changing it globally will affect memory utilization since buffer allocation will use the higher value for everything, so I would probably raise the limit for those sourcetypes that need it. It also adds a level of 'documentation' to your sourcetype configuration that maybe helpful in understanding the input's characteristics.

View solution in original post

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Yes, that would be the proper approach based on conf file precedence

However, changing it globally will affect memory utilization since buffer allocation will use the higher value for everything, so I would probably raise the limit for those sourcetypes that need it. It also adds a level of 'documentation' to your sourcetype configuration that maybe helpful in understanding the input's characteristics.

0 Karma

brent_weaver
Builder

Thank you for the great info... Totally makes sense. I will do it for the sourcetypes that need it. Do I need to consider the the UF config for those ST's affected? Do I need to do the same thing on the UF side?

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Nope, only relevant where parsing happens, i.e. Heavy Forwarder (if used) or indexer.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...