Why is indexed extraction not working if json HEC event payload is more than 512KB?

[hrawat]

With INDEXED_EXTRACTIONS=JSON, indexed extraction is not working if json HEC  event payload is more than 512KB.

[hrawat · Accepted solution]

It's a known issue for HEC that for indexed extraction `maxEventSize`  is not honored hence max json payload is 512KB.
Splunk 9.0 and above issue is fixed.