Splunk Cloud Platform

Issue with large file size not getting read in Splunk

paragg
Loves-to-Learn Lots

For a particular sourcetype I am facing log ingestion issue. Getting below error. 
As checked with the team, this log file can not be split. So is there any solution to resolve this issue.

paragg_0-1739218887388.png

 

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

That's a warning, not an error.  The file will be ingested, but while Splunk is busy with it other monitored files are ignored.

Consider standing up a separate UF on that server just for the large files.

Also, make sure maxKBps in limits.conf is set to 0 or the largest value the network can support.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

 Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team for an ...