Getting Data In

Why is my TCP Input data being cut off? Is there a limit I can configure?


Hello experts,

I am using the TCP input "channel" in order to get data into splunk (inputs.conf):

connection_host = dns
index = myIndex
sourcetype = json

However, when I send slightly larger packets, it gets cut off. It seems to be the case that there is some size limit which I am exceeding. Now I am wondering if it is possible to configure these limits and set them higher.


Path Finder

Add "Truncate" to your props.conf:

 connection_host = dns
 index = myIndex
 sourcetype = json
TRUNCATE = 16000



I'm using TCP socket to stream data to Splunk. Every JSON packet bigger than 10KB is cut off.

Get Updates on the Splunk Community!

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...