Getting Data In

Why is my TCP Input data being cut off? Is there a limit I can configure?

MemoreX42
Explorer

Hello experts,

I am using the TCP input "channel" in order to get data into splunk (inputs.conf):

[tcp://558]
connection_host = dns
index = myIndex
sourcetype = json

However, when I send slightly larger packets, it gets cut off. It seems to be the case that there is some size limit which I am exceeding. Now I am wondering if it is possible to configure these limits and set them higher.

Thanks,
Christian

jnicholsenernoc
Path Finder

Add "Truncate" to your props.conf:

 [tcp://558]
 connection_host = dns
 index = myIndex
 sourcetype = json
TRUNCATE = 16000

http://docs.splunk.com/Documentation/Splunk/6.2.3/Admin/Propsconf

op1ekun
Engager

+1

I'm using TCP socket to stream data to Splunk. Every JSON packet bigger than 10KB is cut off.

Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...