Splunk Search

Where can I change the maximum of the event length to prevent that events are truncated at index-time

rrovers
Contributor

Events longer than 15.000 characters are truncated now. 

  • We wonder if there is a limit for this (so for example in the configuration the maximum event length can't be set to a number higher than 50.000).
  • Where and how can we change this limit for a certain index.
0 Karma

tej57
Builder

Hello @rrovers,

You can update the truncate limit on the first Splunk Enterprise instance that the data encounters. If your data flow is UF -> IUF -> Indexers or UF -> Indexers, in that case you need to place the following sourcetype on the indexers. And if your data flow is UF -> IHF -> Indexers, in that case you'll need to place the sourcetype configuration on the IHF. Here, IUF and IHF refer to Intermediate Universal Forwarder and Intermediate Heavy Forwarder respectively.

[<<sourcetype>>]
TRUNCATE = <<max_length_of_event>>

Also, you can set TRUNCATE to any value you wish. 

---
Thanks,
Tejas.

Get Updates on the Splunk Community!

BORE at .conf25

Boss Of Regular Expression (BORE) was an interactive session run again this year at .conf25 by the brilliant ...

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...

UCC Framework: Discover Developer Toolkit for Building Technology Add-ons

The Next-Gen Toolkit for Splunk Technology Add-on Development The Universal Configuration Console (UCC) ...