Splunk rejects syslog messages

[bosseres]

Hello, everyone

I've "all-in-one" splunk installation, configured syslog input, but input messages are rejected.

Below messages from splunkd.log

12-21-2022 09:24:24.966 +0300 ERROR TcpInputProc - Message rejected. Received unexpected message of size=1009858353 bytes from src=*:60020 in streaming mode. Maximum message size allowed=67108864. (::) Possible invalid source sending data to splunktcp port or valid source sending unsupported payload.
12-21-2022 09:24:24.969 +0300 ERROR TcpInputProc - Message rejected. Received unexpected message of size=1009987646 bytes from src=*:60032 in streaming mode. Maximum message size allowed=67108864. (::) Possible invalid source sending data to splunktcp port or valid source sending unsupported payload.
12-21-2022 09:24:24.975 +0300 ERROR TcpInputProc - Message rejected. Received unexpected message of size=1009858353 bytes from src=*:60034 in streaming mode. Maximum message size allowed=67108864. (::) Possible invalid source sending data to splunktcp port or valid source sending unsupported payload.
12-21-2022 09:24:31.739 +0300 ERROR TcpInputProc - Message rejected. Received unexpected message of size=1009858353 bytes from src=*:49684 in streaming mode. Maximum message size allowed=67108864. (::) Possible invalid source sending data to splunktcp port or valid source sending unsupported payload.

Tried to increase queueSize in inputs.conf, but without success result

[richgalloway]

The messages are saying Splunk can't accept 1GB messages - the maximum is 64MB.  Verify the data coming in is indeed syslog and, if so, have the senders dial back the amount they send at a time.  If the data is not syslog then it should not be coming to a syslog input.

FTR, it's a Best Practice to receive syslog events via a dedicated syslog server (syslog-ng, rsyslog, SC4S) rather than directly to a Splunk instance.