How can we apply TRUNCATE across many sourcetypes?

[ddrillic]

We would like to set TRUNCATE=0 so we don't truncate the events at all. We normally use the sourcetype in props.conf. However, the customer has many sourcetypes. Can we use wildcard to specify the set sourcetypes or the indexes (which we have four)?

Maybe we can do it as a global setting for all apps?

[somesoni2 · Accepted solution]

The TRUNCATE is props.conf setting which applies to sourcetype or source or host (not index). For source and host, you can use wildcard as usual. The sourcetype doesn't allow wildcard as such but you can use a regex hack, as explained in below page, to use sort of wildcard.

https://www.splunk.com/blog/2014/07/31/quick-tip-wildcard-sourcetypes-in-props-conf.html

Again, it's a hack to it's officially not supported. For move caveats, read the 2nd (unaccepted) answer from below post.
https://answers.splunk.com/answers/8505/is-it-possible-to-use-wildcards-in-sourcetype-props-conf-sta...

[ddrillic]

Gorgeous @somesoni2 - can we simply do it across all data?

[somesoni2]

In props.conf, there is a [default] stanza. Adding TRUNCATE=0 there will apply that setting to all sourcetypes. You can override this setting at each sourcetype level too.

[ddrillic]

Perfect - I really don't see a reason to truncate anything.... much appreciated.