Where do I change the maximum Message body length?

[gregbo]

I'm trying to get a large text file ingested using the HEC.  In my searches for the data, I see events that say "Message body length 3169085 greater than maximum allowed (2097152).  Where can I change that maximum?  I can't find any setting that says "Message body length", and I can't find any setting set to 2097152

[Roy_9]

Keep the truncate limit to 0 on the sourcetype, hopefully it should fix the problem.

[gregbo]

Thanks for the info,  I tried the solution in that article and it made to difference.  My error message is different than the one in that article.

[kamlesh_vaghela]

@gregbo 

Check: https://www.splunk.com/en_us/blog/tips-and-tricks/handling-http-event-collector-hec-content-length-t...

kV