Getting Data In

How to handle huge payloads in splunk



We have a usecase where the Json payloads are more than 1 million bytes, our current truncation limit is set to default 10000 bytes, we don't have an option to set this to 0 since our env is splunk cloud and splunk support didn't agreed to set it to 0, is there an alternative way to overcome this situation?

Please let me know if anyone ever faced this situation




0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!