Is there character limits in previous Splunk version?

[xRusty9]

Hi, 

May I check whether is there character limits when sending data to Splunk? Is there 10000 limit on Splunk Enterprise version 8.0.5?

Thanks!

[xRusty9]

I do see that props.conf have a few TRUNCATE setting. Do I change all of them so that longer message can be loaded in Splunk? or I change the default, splunkd, and KVstore will do?

[SanjayReddy]

Hi @xRusty9 

Defult is 10k , for all for splunk versions,  this value present in $Splunk_Home/etc/system/default/props.conf

if you wante to increase the limit please update in local directory 

TRUNCATE = <non-negative integer>
* The default maximum line length, in bytes.
* Although this is in bytes, line length is rounded down when this would
  otherwise land mid-character for multi-byte characters.
* Set to 0 if you never want truncation (very long lines are, however, often
  a sign of garbage data).
* Default: 10000

this can be based on source or sourcetype or host in props.conf 
ex:

[host::small_events]
TRUNCATE = 256

---
If this reply helps you, an upvote/Karma would be appreciated.

[xRusty9]

Hi, thanks for the reply. I am using the latest version(9.0.1) and the older version(8.0.5), and 9.0.1 able to send more than 10k of data without changing the configuration. Whereas 8.0.5 truncate around 10k. 

[SanjayReddy]

Hi @xRusty9 

Can you following command from splunk bin directory  on both 9.0.1 and 8.0.5  servers to check any local configuration that updated?

./splunk btool props list --debug | grep -i TRUNCATE

[xRusty9]

Hi @SanjayReddy ,

I do see that props.conf have a few TRUNCATE setting. Do I change all of them so that longer message can be loaded in Splunk? or I change the default, splunkd, and KVstore will do?

Just to update:

I tried to add the following under the $Splunk_Home/etc/system/default/props.conf, the truncate didnt happen in version 9.0.5. 

[host::127.0.0.1:8088]
TRUNCATE = 256

My data came in via HEC.

[SanjayReddy]

Hi @xRusty9 

remove port from header and save it

check if that is working?