Splunk Cloud Platform

Splunk Cloud Event truncated after 10kb- Is there a way to send events to Splunk Cloud larger than 10kb?

murally
Engager

Hi,

I have a Splunk Cloud trial instance. I am using a Sprint Boot application to make a simple HttpPost call to the HEC in Batch mode.  The format of the event is JSON and I am not adding line breaks between two events. 

Splunk is receiving the requests and adding them as events. However, each of my events is getting truncated and is not showing up as a well formed JSON. I can see that the entire event is not being added, and when I measured the size of each event, it was coming up to 10kb.

I then found this: https://docs.splunk.com/Documentation/Splunk/latest/Data/Configureeventlinebreaking

Specifically, I think I'm being impacted by this:

The Splunk platform uses the LINE_BREAKER and TRUNCATE settings to evaluate and break events over 10kB into multiple lines of 10kB each.

Questions

1. Is there no way to send events to Splunk Cloud larger than 10 kb?

2. If it is indeed supported, what configuration do we need which can be performed via Splunk Web, since we don't have access to config files etc in Splunk Cloud? Is it something related to Source Types (Advanced config)?

Labels (1)
Tags (2)
0 Karma
1 Solution

Roy_9
Motivator

@murally you could increase the truncate limit to a higher number under sourcetype settings-->advanced.

Suppose, if you keep the number to 0 it means unlimited.

View solution in original post

0 Karma

Roy_9
Motivator

@murally you could increase the truncate limit to a higher number under sourcetype settings-->advanced.

Suppose, if you keep the number to 0 it means unlimited.

0 Karma

murally
Engager

By the time I could do that, my splunk trial expired 😞 But I'll keep this suggestion in mind for future. Thanks!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...