How to check size allocated to source-type and what is the maximum size of a transaction that sourcetype can hold

[MP5591]

How to check size allocated to source-type and what is the maximum size of a transaction that sourcetype can hold

[Sukisen1981]

are you asking size and retention of sourcetype or index?
One index has data size / time to retention bucket roll over policies. It can have multiple source / sourcetypes, that does not matter.
But I am thinking that perhaps you are asking for something else?

[MP5591]

@Sukisen1981 -Thanks for responding.

I was asking about sourcetype. How to know the size allocated to sourcetype. Also what is the limit on the size data we pass in a transaction? we see that transaction with 1mB data is not getting logged in

[jawaharas]

Little more detail will be helpful to assist you.

What you mean by transaction with 1 MB data? Is it log file size or single log event size?

Can you post your inputs.conf file config from Universal Forwarder for the sourcetype?

[kmorris_splunk]

To @Sukisen1981's point, sourcetype has no size associated with it. You define the size of an index. Sourcetype is simply a way of categorizing your data.

[MP5591]

@jawaharas-its single log event of size 1 MB. is there any limit on this .

[somesoni2]

A real-life transaction may contain multiple Splunk "events" (based on how the sourcetype is breaking events in your log file. The default size of an event is 10,000 bytes after which an event will be truncated (not dropped fully, just first 10,000 bytes are retained). You can change this by setting up TRUNCATE attribute for your sourcetype. You can refer to following Splunk documentation for information on various sourcetype level attributes:
https://docs.splunk.com/Documentation/Splunk/latest/admin/Propsconf#Line_breaking