Getting Data In

Why my truncate configuration on my universal forwarder is not working?

Explorer

Hi All,

I setup one universal forwarder on my windows server and forward the logs to my linux splunk instance, and the events are truncated to 10000.

I tried set the truncate settings in my forwarder, and it doesn’t work at all, here’s my configuration:

E:\services\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\local\inputs.conf

[monitor://E:\logs]

**TRUNCATE = 0**

disabled = false

Can someone help that?

1 Solution

Motivator

You need to put the TRUNCATE setting in the indexer, in a props.conf file

something like:

[yoursourcetype]
TRUNCATE = 0 

Restart the indexer after changing this setting

Regards

View solution in original post

Motivator

You need to put the TRUNCATE setting in the indexer, in a props.conf file

something like:

[yoursourcetype]
TRUNCATE = 0 

Restart the indexer after changing this setting

Regards

View solution in original post

Explorer

Thanks all. We resolved the issue with heavy forwarder instead of universal forwarder. The TRUNCATE setting doesn't work in universal forwarder not matter i put it into the props.conf or input.conf.

Final solution:
1. added below configuration in indexer's props.conf.
[yoursourcetype]
TRUNCATE = 0

  1. Setup one heavy forwarder (install full splunk and change it's license to forwarder).

  2. Added below configuration in heavy forwarder's etc\
    system\local\props.conf
    [yoursourcetype]
    TRUNCATE = 0

  3. it works as excepted.

SplunkTrust
SplunkTrust

This attribute is applicable for props.conf only (on indexer). Inputs.conf (on universal forwarder) need not be changed.

0 Karma

Explorer

Thanks. I will try. Besides, do i need modify the inputs.conf and props.conf both?

0 Karma