I would like to know if it's possible to globally increase the size of events to be indexed:
I have a CSV file and my fields name line have more than 4096 characters.
TRUNCATE in Splunk documentation, but if I understand correctly
LOOKAHEAD is used with a transforms command. However, I don't need to use any.
I tried to add
TRUNCATE=10000 to my sourcetype in props.conf, but I doesn't seems to work: after indexing, when I'm looking for some fields, they are always missing.
Could someone explain to me what I have to do for this issue?
Thanks in advance for any help
Thanks!! That was exactly what I needed. Hard to sometimes find good keywords^^