Why my truncate configuration on my universal forwarder is not working?

[qiye]

Hi All,

I setup one universal forwarder on my windows server and forward the logs to my linux splunk instance, and the events are truncated to 10000.

I tried set the truncate settings in my forwarder, and it doesn’t work at all, here’s my configuration:

E:\services\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\local\inputs.conf

[monitor://E:\logs]

**TRUNCATE = 0**

disabled = false

Can someone help that?

[gfuente · Accepted solution]

You need to put the TRUNCATE setting in the indexer, in a props.conf file

something like:

[yoursourcetype]
TRUNCATE = 0 

Restart the indexer after changing this setting

Regards

[qiye]

Thanks all. We resolved the issue with heavy forwarder instead of universal forwarder. The TRUNCATE setting doesn't work in universal forwarder not matter i put it into the props.conf or input.conf.

Final solution:
1. added below configuration in indexer's props.conf.
[yoursourcetype]
TRUNCATE = 0

1. Setup one heavy forwarder (install full splunk and change it's license to forwarder).

2. Added below configuration in heavy forwarder's etc\
   system\local\props.conf
   [yoursourcetype]
   TRUNCATE = 0

3. it works as excepted.

[somesoni2]

This attribute is applicable for props.conf only (on indexer). Inputs.conf (on universal forwarder) need not be changed.

[qiye]

Thanks. I will try. Besides, do i need modify the inputs.conf and props.conf both?