Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About adammike
adammike
New Member
Member since:
06-18-2019
06-05-2020
Community Statistics
| Posts | 5 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 06-18-2019 |
Activity Feed
- Posted Re: Is it possible to change the MaxValueSize for HEC? on Getting Data In. 06-20-2019 12:51 PM
- Posted Re: ERROR failed to post events "invalid data format": Are these bad? on Getting Data In. 06-20-2019 08:35 AM
- Posted Re: An issue with the HTTP Event Collector (HEC) has been identified in Splunk 7.x on Getting Data In. 06-19-2019 02:57 PM
- Posted Is it possible to change the MaxValueSize for HEC? on Getting Data In. 06-19-2019 02:21 PM
- Tagged Is it possible to change the MaxValueSize for HEC? on Getting Data In. 06-19-2019 02:21 PM
- Tagged Is it possible to change the MaxValueSize for HEC? on Getting Data In. 06-19-2019 02:21 PM
- Posted ERROR failed to post events "invalid data format": Are these bad? on Getting Data In. 06-18-2019 10:26 AM
- Tagged ERROR failed to post events "invalid data format": Are these bad? on Getting Data In. 06-18-2019 10:26 AM
- Tagged ERROR failed to post events "invalid data format": Are these bad? on Getting Data In. 06-18-2019 10:26 AM
- Tagged ERROR failed to post events "invalid data format": Are these bad? on Getting Data In. 06-18-2019 10:26 AM
- Tagged ERROR failed to post events "invalid data format": Are these bad? on Getting Data In. 06-18-2019 10:26 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 |
06-20-2019
12:51 PM
One of the engineers at Splunk was able to help me out. This resolved the issue for me.
[http]
disabled = 0
maxEventSize = 15728640
Here is the email I got that explains it:
Hello Mike,
To address the issue referenced below, a new global setting called maxEventSize under [http] stanza in inputs.conf has been introduced to allow customers to configure the expected maximum size of HEC event as part of these releases 7.0.5, 7.0.3.7, 7.1.3, and later.
A workaround for this issue is to have 6.x based HWFs parse the HEC events before forwarding to indexers.
Please let me know if you have any additional question.
... View more
06-20-2019
08:35 AM
The root cause of this is that HEC is rejecting specific log entries because they are too large. I have opened an additional question to figure out how to fix that.
https://answers.splunk.com/answers/753896/is-it-possible-to-change-the-maxvaluesize-for-hec.html#question-753896
... View more
06-19-2019
02:57 PM
and we also plan to make the limit configurable to suit specific needs
How do I configure this? I can't find anything in the docs or online
... View more
06-19-2019
02:21 PM
Getting a ton of this, and it's making Kafka Connect really grumpy. Any way to increase MaxValueSize?
06-19-2019 17:16:54.627 -0400 ERROR HttpInputDataHandler - Parsing error : While expecting event's raw text: String value too long. valueSize=5247864, maxValueSize=5242880, totalRequestSize=6963917
06-19-2019 17:17:14.622 -0400 ERROR HttpInputDataHandler - Parsing error : While expecting event's raw text: String value too long. valueSize=5247864, maxValueSize=5242880, totalRequestSize=6963917
06-19-2019 17:17:34.629 -0400 ERROR HttpInputDataHandler - Parsing error : While expecting event's raw text: String value too long. valueSize=5247864, maxValueSize=5242880, totalRequestSize=6963917
06-19-2019 17:17:54.624 -0400 ERROR HttpInputDataHandler - Parsing error : While expecting event's raw text: String value too long. valueSize=5247864, maxValueSize=5242880, totalRequestSize=6963917
06-19-2019 17:18:14.628 -0400 ERROR HttpInputDataHandler - Parsing error : While expecting event's raw text: String value too long. valueSize=5247864, maxValueSize=5242880, totalRequestSize=6963917
06-19-2019 17:18:34.624 -0400 ERROR HttpInputDataHandler - Parsing error : While expecting event's raw text: String value too long. valueSize=5247864, maxValueSize=5242880, totalRequestSize=6963917
06-19-2019 17:18:54.623 -0400 ERROR HttpInputDataHandler - Parsing error : While expecting event's raw text: String value too long. valueSize=5247864, maxValueSize=5242880, totalRequestSize=6963917
06-19-2019 17:19:14.626 -0400 ERROR HttpInputDataHandler - Parsing error : While expecting event's raw text: String value too long. valueSize=5247864, maxValueSize=5242880, totalRequestSize=6963917
06-19-2019 17:19:34.619 -0400 ERROR HttpInputDataHandler - Parsing error : While expecting event's raw text: String value too long. valueSize=5247864, maxValueSize=5242880, totalRequestSize=6963917
... View more
06-18-2019
10:26 AM
Looks like I have a malformed record in Kafka, I assume that it will keep trying to post the invalid events until the data ages out of the topic in some number of days? I still see data flowing from Kafka into HEC, so I'm not sure if this is a problem or not. I'd like to be sure one way or the other.
Jun 18 10:16:56 a0001p5rlog0003 messages [2019-06-18 12:16:23,464] ERROR failed to post events resp={"text":"Invalid data format","code":6,"invalid-event-number":8,"ackId":7672}, status=400 (com.splunk.hecclient.Indexer:181)
Jun 18 10:16:56 a0001p5rlog0003 messages [2019-06-18 12:16:23,465] INFO add 1 failed batches (com.splunk.kafka.connect.SplunkSinkTask:322)
Jun 18 10:16:56 a0001p5rlog0003 messages [2019-06-18 12:16:23,465] INFO total failed batches 1 (com.splunk.kafka.connect.SplunkSinkTask:47)
Jun 18 10:16:56 a0001p5rlog0003 messages [2019-06-18 12:16:23,465] INFO handled 1 failed batches with 9 events (com.splunk.kafka.connect.SplunkSinkTask:130)
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
