Getting Data In

Is there an upper limit on maxEventSize of outputs.conf?

HiroshiSatoh
Champion

Currently, we make the following settings, but we have confirmed the phenomenon that the log is interrupted at about 2000 bytes.

[Syslog: win-event-log]
・・・・・
Type = tcp
MaxEventSize = 65536

As the setting of the receiving side rsyslog, the size is set to a large value ($ MaxMessageSize 64k).

Splunk 6.5.1
Linux

0 Karma
1 Solution

mattymo
Splunk Employee
Splunk Employee

No upper limit is posted in the spec file

maxEventSize = <integer>
* If specified, sets the maximum size of an event that splunk will transmit.
* All events excedding this size will be truncated.
* Defaults to 1024 bytes.

https://docs.splunk.com/Documentation/Splunk/6.5.2/Admin/Outputsconf

Are you forwarding from Splunk to rsyslog?

- MattyMo

View solution in original post

0 Karma

mattymo
Splunk Employee
Splunk Employee

No upper limit is posted in the spec file

maxEventSize = <integer>
* If specified, sets the maximum size of an event that splunk will transmit.
* All events excedding this size will be truncated.
* Defaults to 1024 bytes.

https://docs.splunk.com/Documentation/Splunk/6.5.2/Admin/Outputsconf

Are you forwarding from Splunk to rsyslog?

- MattyMo

View solution in original post

0 Karma

HiroshiSatoh
Champion

Yes, I am transferring from Splunk to rsyslog.

0 Karma

mattymo
Splunk Employee
Splunk Employee

Are you using a Heavy Forwarder?

Docs states sending syslog out needs a heavy forwarder, and also mentions using the SEDCMD to remove new lines from Win events...I have seen new lines cause some havoc with events sent to syslog servers, breaking events into multiple pieces...

You can specify a SEDCMD configuration in props.conf to address data that contains characters that the third-party server cannot process. This option is useful for removing newline characters from Windows Event Log events.

http://docs.splunk.com/Documentation/Splunk/6.5.2/Forwarding/Forwarddatatothird-partysystemsd

- MattyMo
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!