Getting Data In

Where do I change the maximum Message body length?

gregbo
Communicator

I'm trying to get a large text file ingested using the HEC.  In my searches for the data, I see events that say "Message body length 3169085 greater than maximum allowed (2097152).  Where can I change that maximum?  I can't find any setting that says "Message body length", and I can't find any setting set to 2097152

Labels (2)
0 Karma

PA1
Builder

Keep the truncate limit to 0 on the sourcetype, hopefully it should fix the problem.

0 Karma

gregbo
Communicator

Thanks for the info,  I tried the solution in that article and it made to difference.  My error message is different than the one in that article.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust
0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

<P style=" text-align: center; "><span class="lia-inline-image-display-wrapper lia-image-align-center" ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

<FONT size="5"><FONT size="5" color="#FF00FF">Get the latest news and updates from the Splunk Community ...