How to change max limit of event from 10000 bytes in Splunk Cloud ?
Best practice is to create an app, call it (your_company_name)_all_indexers or something to that effect, create a default subdirectory and in there populate an app.conf (requirement for Splunk Cloud in particular for versioning) and a props.conf. Splunk best practice is to create apps with the name of the authoring organization and the app's target component in the infrastructure (can be a Splunk tier, a particular source, etc etc). In this case I chose "all_indexers" as the target tier.
In the props.conf put the TRUNCATE=(some #>10000) in the stanzas you create per the Splunk documentation for props (Google Splunk props.conf.spec).
Then, submit it for distribution to your indexers from the cluster master.
I guess you need to contact Splunk Support team to change this value in conf file directly for respective sourcetype.
indeed, contact your Cloud Support team.
if you can not, find out who in your organization has their name on the account