Why is indexed extraction not working if json HEC event payload is more than 512KB?

[hrawat_splunk]

With INDEXED_EXTRACTIONS=JSON, indexed extraction is not working if json HEC  event payload is more than 512KB.

[hrawat_splunk · Accepted solution]

It's a known issue for HEC that for indexed extraction `maxEventSize`  is not honored hence max json payload is 512KB.
Splunk 9.0 and above issue is fixed.