HttpEventCollector - What is the max number of log send in one POST command?

[arielgilad]

How many log events can be sent in one http POST command?  Is there a limit?  What is the limit size of the payload.

[isoutamo]

Hi

From https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf#http:_.28HTTP_Event_Collector.2... you could found

maxEventSize = <positive integer>[KB|MB|GB]
* The maximum size of a single HEC (HTTP Event Collector) event.
* HEC disregards and triggers a parsing error for events whose size is
  greater than 'maxEventSize'.
* Default: 5MB

r. Ismo 

[arielgilad]

Thanks for your reply.
As I understand you answered on per event size.  This is up to to 5MB.
My question refer to the limit of number of batched event sent in one http POST command.  Can I send, for example 1000 event in one batch?  is there a limit?  per the number of event in a batch?

[isoutamo]

I'm not sure what that is. Couldn't found anything with quickly googling. Server will told to you if it's too long ; -)

Anyhow I suppose to keep the batch size reasonable to avoid other resource issues and if something fails you probably lost the batch?

r. Ismo