Maximum size of HTTP POST Request and receivers/stream endpoint

[stevanic]

Hi community,

I got a couple of questions regarding POST request to receivers/stream endpoint.

1. I have used API endpoint receivers/stream to upload events to Splunk and I am just wondering what is the maximum size of HTTP POST request Splunk API can accept.

2. If e.g. the maximum is 10 MB, does this mean that if I want to submit 20 MB data, I need to breakdown the data and submit it in two requests?

3. How long does streaming API socket remain open after the initial request? In Python script examples in REST api documentation, the code tries to send a request every second and I'm just wondering what is the maximum interval between request before the connection is closed.

Thanks in advance.

[stevanic · Accepted solution]

Maximum size of HTTP request is specified in limits.conf->max_content_length