Is there an upper limit on maxEventSize of outputs.conf?

[HiroshiSatoh]

Currently, we make the following settings, but we have confirmed the phenomenon that the log is interrupted at about 2000 bytes.

[Syslog: win-event-log]
･････
Type = tcp
MaxEventSize = 65536

As the setting of the receiving side rsyslog, the size is set to a large value ($ MaxMessageSize 64k).

Splunk 6.5.1
Linux

[mattymo · Accepted solution]

No upper limit is posted in the spec file

maxEventSize = <integer>
* If specified, sets the maximum size of an event that splunk will transmit.
* All events excedding this size will be truncated.
* Defaults to 1024 bytes.

https://docs.splunk.com/Documentation/Splunk/6.5.2/Admin/Outputsconf

Are you forwarding from Splunk to rsyslog?

[HiroshiSatoh]

Yes, I am transferring from Splunk to rsyslog.

[mattymo]

Are you using a Heavy Forwarder?

Docs states sending syslog out needs a heavy forwarder, and also mentions using the SEDCMD to remove new lines from Win events...I have seen new lines cause some havoc with events sent to syslog servers, breaking events into multiple pieces...

You can specify a SEDCMD configuration in props.conf to address data that contains characters that the third-party server cannot process. This option is useful for removing newline characters from Windows Event Log events.

http://docs.splunk.com/Documentation/Splunk/6.5.2/Forwarding/Forwarddatatothird-partysystemsd