Is it possible to globally increase the size of events to be indexed (LOOKAHEAD, TRUNCATE)?

[MaryvonneMB]

Hi,

I would like to know if it's possible to globally increase the size of events to be indexed:
I have a CSV file and my fields name line have more than 4096 characters.
I found LOOKAHEAD and TRUNCATE in Splunk documentation, but if I understand correctly LOOKAHEAD is used with a transforms command. However, I don't need to use any.
I tried to add TRUNCATE=10000 to my sourcetype in props.conf, but I doesn't seems to work: after indexing, when I'm looking for some fields, they are always missing.

Could someone explain to me what I have to do for this issue?

Thanks in advance for any help

[somesoni2 · Accepted solution]

Have a look at this post

https://answers.splunk.com/answers/86931/why-does-the-splunk-indexes-only-50-fields-out-of-120-field...

[MaryvonneMB]

Thanks!! That was exactly what I needed. Hard to sometimes find good keywords^^