Getting Data In

Syslog Universal Forwarder truncated at 1024 bytes

someyoungfella
New Member

Hi there,

I'm using a Splunk UF to monitor a Windows folder and syslog the events to a remote server where they are collected and written to Hadoop.

From reading previous questions here, I understand that the syslog universal forwarder is RFC 3164 compliant. That is, events have a maximum length of 1024 bytes, after which they are truncated. I was wondering if there are plans to change that (perhaps by implementing RFC 5424?). If not, could anyone suggest an alternative?

Thanks in advance.

0 Karma

SK110176
Path Finder

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Outputsconf

----Syslog output----

maxEventSize =
* If specified, sets the maximum size of an event that splunk will transmit.
* All events excedding this size will be truncated.
* Defaults to 1024 bytes.

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

 Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team for an ...