Getting Data In

How to check size allocated to source-type and what is the maximum size of a transaction that sourcetype can hold

MP5591
New Member

How to check size allocated to source-type and what is the maximum size of a transaction that sourcetype can hold

Tags (1)
0 Karma

Sukisen1981
Champion

are you asking size and retention of sourcetype or index?
One index has data size / time to retention bucket roll over policies. It can have multiple source / sourcetypes, that does not matter.
But I am thinking that perhaps you are asking for something else?

0 Karma

MP5591
New Member

@Sukisen1981 -Thanks for responding.

I was asking about sourcetype. How to know the size allocated to sourcetype. Also what is the limit on the size data we pass in a transaction? we see that transaction with 1mB data is not getting logged in

0 Karma

jawaharas
Motivator

Little more detail will be helpful to assist you.

What you mean by transaction with 1 MB data? Is it log file size or single log event size?

Can you post your inputs.conf file config from Universal Forwarder for the sourcetype?

0 Karma

kmorris_splunk
Splunk Employee
Splunk Employee

To @Sukisen1981's point, sourcetype has no size associated with it. You define the size of an index. Sourcetype is simply a way of categorizing your data.

0 Karma

MP5591
New Member

@jawaharas-its single log event of size 1 MB. is there any limit on this .

0 Karma

somesoni2
SplunkTrust
SplunkTrust

A real-life transaction may contain multiple Splunk "events" (based on how the sourcetype is breaking events in your log file. The default size of an event is 10,000 bytes after which an event will be truncated (not dropped fully, just first 10,000 bytes are retained). You can change this by setting up TRUNCATE attribute for your sourcetype. You can refer to following Splunk documentation for information on various sourcetype level attributes:
https://docs.splunk.com/Documentation/Splunk/latest/admin/Propsconf#Line_breaking

Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...