Getting Data In

Is it possible to globally increase the size of events to be indexed (LOOKAHEAD, TRUNCATE)?

MaryvonneMB
Path Finder

Hi,

I would like to know if it's possible to globally increase the size of events to be indexed:
I have a CSV file and my fields name line have more than 4096 characters.
I found LOOKAHEAD and TRUNCATE in Splunk documentation, but if I understand correctly LOOKAHEAD is used with a transforms command. However, I don't need to use any.
I tried to add TRUNCATE=10000 to my sourcetype in props.conf, but I doesn't seems to work: after indexing, when I'm looking for some fields, they are always missing.

Could someone explain to me what I have to do for this issue?

Thanks in advance for any help

0 Karma
1 Solution

MaryvonneMB
Path Finder

Thanks!! That was exactly what I needed. Hard to sometimes find good keywords^^

0 Karma
Get Updates on the Splunk Community!

Thanks for the Memories! Splunk University, .conf24, and Community Connections

Thank you to everyone in the Splunk Community who joined us for .conf24 – starting with Splunk University and ...

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...