Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- event size limit
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The default event size limit is 10000 characters. You can override this in props.conf as follows
[yoursourcetypehere]
TRUNCATE = 0
MAX_EVENTS = 10000
Setting TRUNCATE to zero means "no truncation". MAX_EVENTS actually sets "the maximum number of lines per event." MAX_EVENTS only applies to multi-line events, but the default is 256 lines. If you are dealing with multi-line events, you may want to set this to a much larger value.
You can put the props.conf file under an application, if it is application-specific, or under /etc/system/local
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The default event size limit is 10000 characters. You can override this in props.conf as follows
[yoursourcetypehere]
TRUNCATE = 0
MAX_EVENTS = 10000
Setting TRUNCATE to zero means "no truncation". MAX_EVENTS actually sets "the maximum number of lines per event." MAX_EVENTS only applies to multi-line events, but the default is 256 lines. If you are dealing with multi-line events, you may want to set this to a much larger value.
You can put the props.conf file under an application, if it is application-specific, or under /etc/system/local
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
hi @lguinn2 , I updated the props.conf in my indexer and forwarder but my data still get truncated to 100 KB.
According to this answer https://answers.splunk.com/answers/155691/why-are-larger-events-are-truncated-10000-bytes.html .. I also need to update the Heavy Forwarder's props.conf file. Do you know how to find out if my data flows thru the HWF before getting into the indexer?
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
