Safe TRUNCATE value on json events

[andreibanaru]

What would be a “safe” value for the TRUNCATE option in props.conf?

I have some pretty big json events coming via HEC hitting the _json sourcetype (INDEXED_EXTRACTIONS=json).

[richgalloway]

"Safe" is a relative term.  To avoid all event truncations, the "safe" setting is TRUNCATE = 0, but that runs the risk of multiple events that are not line-broken correctly being ingested as a single event without warning.

Another "safe" approach is to set TRUNCATE to a reasonable value based on the expected event size plus a margin for error (maybe 10%).  If the logs indicate an event was truncated then investigate to see if the line-breaking settings should be changes or if the TRUNCATE setting should be increase.  Adjust and repeat.