Why is my TCP Input data being cut off? Is there a limit I can configure?

[MemoreX42]

Hello experts,

I am using the TCP input "channel" in order to get data into splunk (inputs.conf):

[tcp://558]
connection_host = dns
index = myIndex
sourcetype = json

However, when I send slightly larger packets, it gets cut off. It seems to be the case that there is some size limit which I am exceeding. Now I am wondering if it is possible to configure these limits and set them higher.

Thanks,
Christian

[jnicholsenernoc]

Add "Truncate" to your props.conf:

 [tcp://558]
 connection_host = dns
 index = myIndex
 sourcetype = json
TRUNCATE = 16000

http://docs.splunk.com/Documentation/Splunk/6.2.3/Admin/Propsconf

[op1ekun]

+1

I'm using TCP socket to stream data to Splunk. Every JSON packet bigger than 10KB is cut off.