Splunk Search

Where can I change the maximum of the event length to prevent that events are truncated at index-time

rrovers
Contributor

Events longer than 15.000 characters are truncated now. 

  • We wonder if there is a limit for this (so for example in the configuration the maximum event length can't be set to a number higher than 50.000).
  • Where and how can we change this limit for a certain index.
0 Karma

tej57
Builder

Hello @rrovers,

You can update the truncate limit on the first Splunk Enterprise instance that the data encounters. If your data flow is UF -> IUF -> Indexers or UF -> Indexers, in that case you need to place the following sourcetype on the indexers. And if your data flow is UF -> IHF -> Indexers, in that case you'll need to place the sourcetype configuration on the IHF. Here, IUF and IHF refer to Intermediate Universal Forwarder and Intermediate Heavy Forwarder respectively.

[<<sourcetype>>]
TRUNCATE = <<max_length_of_event>>

Also, you can set TRUNCATE to any value you wish. 

---
Thanks,
Tejas.

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

 Are you ready to revolutionize your IT operations? As digital transformation accelerates, the demand for ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...