Getting Data In

>256 lines events on universal forwarder

0range
Communicator

Hello.
How to load more than 256-line events when we use universal forwarders?

0 Karma

Ayn
Legend

This is not configured on the Universal Forwarders, but on the indexer. See the MAX_EVENTS directive in props.conf: http://docs.splunk.com/Documentation/Splunk/latest/admin/Propsconf

...so, to clarify, what you'd do is put something like this in:

[yoursourcetype]
MAX_EVENTS = 1000

kristian_kolb
Ultra Champion

This is a setting in props.conf on the indexer (or a Heavy Forwarder if you have that as a relay). By default Splunk will cut multline messages at 256 lines, and each line at 10000 bytes. This behaviour can be altered with the MAX_EVENTS and TRUNCATE parameters (respectively), e.g.

props.conf

[my_sourcetype]
SHOULD_LINEMERGE = true
BREAK_ONLY_BEFORE_DATE = true
MAX_EVENTS = 1024
TRUNCATE = 400

The above configuration will allow each message to contain up to 1024 lines, and each line can up to 400 bytes long.

See the documentation for props.conf for further details and other configuration options.

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf

/K

Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...