Where can I change the maximum of the event length to prevent that events are truncated at index-time

[rrovers]

Events longer than 15.000 characters are truncated now. 

• We wonder if there is a limit for this (so for example in the configuration the maximum event length can't be set to a number higher than 50.000).
• Where and how can we change this limit for a certain index.

[tej57]

Hello @rrovers,

You can update the truncate limit on the first Splunk Enterprise instance that the data encounters. If your data flow is UF -> IUF -> Indexers or UF -> Indexers, in that case you need to place the following sourcetype on the indexers. And if your data flow is UF -> IHF -> Indexers, in that case you'll need to place the sourcetype configuration on the IHF. Here, IUF and IHF refer to Intermediate Universal Forwarder and Intermediate Heavy Forwarder respectively.

[<<sourcetype>>]
TRUNCATE = <<max_length_of_event>>

Also, you can set TRUNCATE to any value you wish. 

---
Thanks,
Tejas.