Splunk KVStore API Call : Why is the field Value too Long?

[tdeanesh]

While doing splunk API post call for KVStore one of the field [string] attribute size is large 

so API call fails saying below statement

String value too long. valueSize=526402, maxValueSize=524288

Is there a way we can increase the field [string] length through configuration ?

Please let me know your suggestions

[tdeanesh]

Actually as per Splunk Team. This issue is fixed in Splunk 8.2.6 or higher versions.

So we just need to upgrade to 8.2.6 atleast

Column size is increased from 512 KB. Need to confirm the next max possible Size

[tdeanesh]

Thanks for the reply.

Let me check if we can limit the value below max size allowed for the attribute before inserting into KVStore

[isoutamo]

If you want to use that sized values on kvstore and also use is as lookup which you want to replicate to indexers you will have another issues.... 

[tdeanesh]

Gentle Reminder...

[isoutamo]

Hi

I couldn’t any parameters on limits.conf or server.conf for that. Based on that probably this is not something what you could do by yourself? Maybe spunk support have something more?

Anyhow your value seems to be quite huge! Are you sure that you cannot do something for your data/process to avoiding store this size of thing to kvstore?

r. Ismo