Getting Data In

Changing message size globally in Splunk

brent_weaver
Builder

I have a few sourcetypes that are exceeding the message size limit of 10K and I would like to set this to 32767 for all sourcetypes. I know how to do it for an individual sourcetype, how can I do it globally? Can I put it in etc/system/local/props.conf in the default section?

0 Karma
1 Solution

s2_splunk
Splunk Employee
Splunk Employee

Yes, that would be the proper approach based on conf file precedence

However, changing it globally will affect memory utilization since buffer allocation will use the higher value for everything, so I would probably raise the limit for those sourcetypes that need it. It also adds a level of 'documentation' to your sourcetype configuration that maybe helpful in understanding the input's characteristics.

View solution in original post

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Yes, that would be the proper approach based on conf file precedence

However, changing it globally will affect memory utilization since buffer allocation will use the higher value for everything, so I would probably raise the limit for those sourcetypes that need it. It also adds a level of 'documentation' to your sourcetype configuration that maybe helpful in understanding the input's characteristics.

0 Karma

brent_weaver
Builder

Thank you for the great info... Totally makes sense. I will do it for the sourcetypes that need it. Do I need to consider the the UF config for those ST's affected? Do I need to do the same thing on the UF side?

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Nope, only relevant where parsing happens, i.e. Heavy Forwarder (if used) or indexer.

0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...