What would be a “safe” value for the TRUNCATE option in props.conf?
I have some pretty big json events coming via HEC hitting the _json sourcetype (INDEXED_EXTRACTIONS=json).
"Safe" is a relative term. To avoid all event truncations, the "safe" setting is TRUNCATE = 0, but that runs the risk of multiple events that are not line-broken correctly being ingested as a single event without warning.
Another "safe" approach is to set TRUNCATE to a reasonable value based on the expected event size plus a margin for error (maybe 10%). If the logs indicate an event was truncated then investigate to see if the line-breaking settings should be changes or if the TRUNCATE setting should be increase. Adjust and repeat.