Getting Data In
Highlighted

Is there an upper limit on maxEventSize of outputs.conf?

Champion

Currently, we make the following settings, but we have confirmed the phenomenon that the log is interrupted at about 2000 bytes.

[Syslog: win-event-log]
・・・・・
Type = tcp
MaxEventSize = 65536

As the setting of the receiving side rsyslog, the size is set to a large value ($ MaxMessageSize 64k).

Splunk 6.5.1
Linux

0 Karma
Highlighted

Re: Is there an upper limit on maxEventSize of outputs.conf?

Splunk Employee
Splunk Employee

No upper limit is posted in the spec file

maxEventSize = <integer>
* If specified, sets the maximum size of an event that splunk will transmit.
* All events excedding this size will be truncated.
* Defaults to 1024 bytes.

https://docs.splunk.com/Documentation/Splunk/6.5.2/Admin/Outputsconf

Are you forwarding from Splunk to rsyslog?

View solution in original post

0 Karma
Highlighted

Re: Is there an upper limit on maxEventSize of outputs.conf?

Champion

Yes, I am transferring from Splunk to rsyslog.

0 Karma
Highlighted

Re: Is there an upper limit on maxEventSize of outputs.conf?

Splunk Employee
Splunk Employee

Are you using a Heavy Forwarder?

Docs states sending syslog out needs a heavy forwarder, and also mentions using the SEDCMD to remove new lines from Win events...I have seen new lines cause some havoc with events sent to syslog servers, breaking events into multiple pieces...

You can specify a SEDCMD configuration in props.conf to address data that contains characters that the third-party server cannot process. This option is useful for removing newline characters from Windows Event Log events.

http://docs.splunk.com/Documentation/Splunk/6.5.2/Forwarding/Forwarddatatothird-partysystemsd

0 Karma