event size limit

[sbsbb]

Is there any limit from the event-size ?

My events are truncated, one event is about 3Mo text. Is there a possibility to increase the event size in the config ?

[lguinn2 · Accepted solution]

The default event size limit is 10000 characters. You can override this in props.conf as follows

[yoursourcetypehere]
TRUNCATE = 0
MAX_EVENTS = 10000

Setting TRUNCATE to zero means "no truncation". MAX_EVENTS actually sets "the maximum number of lines per event." MAX_EVENTS only applies to multi-line events, but the default is 256 lines. If you are dealing with multi-line events, you may want to set this to a much larger value.

You can put the props.conf file under an application, if it is application-specific, or under /etc/system/local

[mufthmu]

hi @lguinn2 , I updated the props.conf in my indexer and forwarder but my data still get truncated to 100 KB.
According to this answer https://answers.splunk.com/answers/155691/why-are-larger-events-are-truncated-10000-bytes.html .. I also need to update the Heavy Forwarder's props.conf file. Do you know how to find out if my data flows thru the HWF before getting into the indexer?