Splunk Search

Where can I change the maximum of the event length to prevent that events are truncated at index-time

rrovers
Contributor

Events longer than 15.000 characters are truncated now. 

  • We wonder if there is a limit for this (so for example in the configuration the maximum event length can't be set to a number higher than 50.000).
  • Where and how can we change this limit for a certain index.
0 Karma

tej57
Builder

Hello @rrovers,

You can update the truncate limit on the first Splunk Enterprise instance that the data encounters. If your data flow is UF -> IUF -> Indexers or UF -> Indexers, in that case you need to place the following sourcetype on the indexers. And if your data flow is UF -> IHF -> Indexers, in that case you'll need to place the sourcetype configuration on the IHF. Here, IUF and IHF refer to Intermediate Universal Forwarder and Intermediate Heavy Forwarder respectively.

[<<sourcetype>>]
TRUNCATE = <<max_length_of_event>>

Also, you can set TRUNCATE to any value you wish. 

---
Thanks,
Tejas.

Get Updates on the Splunk Community!

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...

UCC Framework: Discover Developer Toolkit for Building Technology Add-ons

The Next-Gen Toolkit for Splunk Technology Add-on Development The Universal Configuration Console (UCC) ...

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...