Getting Data In

Is it possible to globally increase the size of events to be indexed (LOOKAHEAD, TRUNCATE)?

Path Finder

Hi,

I would like to know if it's possible to globally increase the size of events to be indexed:
I have a CSV file and my fields name line have more than 4096 characters.
I found LOOKAHEAD and TRUNCATE in Splunk documentation, but if I understand correctly LOOKAHEAD is used with a transforms command. However, I don't need to use any.
I tried to add TRUNCATE=10000 to my sourcetype in props.conf, but I doesn't seems to work: after indexing, when I'm looking for some fields, they are always missing.

Could someone explain to me what I have to do for this issue?

Thanks in advance for any help

0 Karma
1 Solution

Path Finder

Thanks!! That was exactly what I needed. Hard to sometimes find good keywords^^

0 Karma