Getting Data In

max value for truncate, max_events


What is the max value for truncate, max_events as my xml files size is 10Mbytes? thks.

Tags (2)
0 Karma

Ultra Champion

Are you really sure that you want a 10MB file in a single event? Actually, I'm not sure that it will really work, i.e. if there are other limitations that are non-configurable. But it's always worth a try.

See the docs:

MAX_EVENTS = <integer>
 * Specifies the maximum number of input lines to add to any event.
 * Splunk breaks after the specified number of lines are read.
 * Defaults to 256 (lines).

TRUNCATE = <non-negative integer>
* Change the default maximum line length (in bytes).
* Although this is in bytes, line length is rounded down when this would
  otherwise land mid-character for multi-byte characters.
* Set to 0 if you never want truncation (very long lines are, however, often a sign of
  garbage data).


0 Karma


Multiple MB in a single event do work from an indexing and searching point of view, whether it makes sense to do that depends on your use case.


I had saw that and confirm that more 20K files in a single event will not work. So i need to remove certain tags in a xml also dont work becuase that particular tag are more than 20K bytes large. So how to split one event into multiple event and also to ensure all the files are forwarded to indexer?

0 Karma
Get Updates on the Splunk Community!

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...

New Customer Testimonials

Enterprises of all sizes and across different industries are accelerating cloud adoption by migrating ...