Getting Data In

Is it possible to globally increase the size of events to be indexed (LOOKAHEAD, TRUNCATE)?

MaryvonneMB
Path Finder

Hi,

I would like to know if it's possible to globally increase the size of events to be indexed:
I have a CSV file and my fields name line have more than 4096 characters.
I found LOOKAHEAD and TRUNCATE in Splunk documentation, but if I understand correctly LOOKAHEAD is used with a transforms command. However, I don't need to use any.
I tried to add TRUNCATE=10000 to my sourcetype in props.conf, but I doesn't seems to work: after indexing, when I'm looking for some fields, they are always missing.

Could someone explain to me what I have to do for this issue?

Thanks in advance for any help

0 Karma
1 Solution

MaryvonneMB
Path Finder

Thanks!! That was exactly what I needed. Hard to sometimes find good keywords^^

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...