How to change max limit of event from 10000 bytes in Splunk Cloud ?

[ajinkya0106aexp]

How to change max limit of event from 10000 bytes in Splunk Cloud ?

[jherring_splunk]

Best practice is to create an app, call it (your_company_name)_all_indexers or something to that effect, create a default subdirectory and in there populate an app.conf (requirement for Splunk Cloud in particular for versioning) and a props.conf. Splunk best practice is to create apps with the name of the authoring organization and the app's target component in the infrastructure (can be a Splunk tier, a particular source, etc etc). In this case I chose "all_indexers" as the target tier.

In the props.conf put the TRUNCATE=(some #>10000) in the stanzas you create per the Splunk documentation for props (Google Splunk props.conf.spec).

Then, submit it for distribution to your indexers from the cluster master.

[harsmarvania57]

I guess you need to contact Splunk Support team to change this value in conf file directly for respective sourcetype.

[adonio]

indeed, contact your Cloud Support team.
if you can not, find out who in your organization has their name on the account