"Accelerated fields have a limitation of 1024 bytes per entry, so you cannot use fields that have more than 1024 bytes" https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/kvstore/usingconfigurationfiles/ ... View more

It might be a duplicate question, but the original post you reference does not solve the issue either. Someone from Splunk should explain why users can't have the choice of determining the size of fields they want to accelerate.  ... View more

Splunk software is full of cases where when can decide on their own how to tune, based on their needs and compute power. There oughta be a default that one can override at their own perril in limits.conf.  ... View more

This seems to be working for me: $SPLUNK_HOME/bin/splunk clear kvstore -app <your_app_name> -collection <collection_name> ... View more

I'm having the same issue. Some input from the Splunk folks would be nice.  ... View more

I does NOT work for me on 7.3.3 either. It fails running this ansible task (splunk-ansible/roles/splunk_common/tasks/wait_for_splunk_instance.yml) : name: Check Splunk instance is running uri: url: "{{ cert_prefix }}://{{ splunk_instance_address }}:{{ splunk.svc_port }}/services/server/info?output_mode=json" method: GET user: "{{ splunk.admin_user }}" password: "{{ splunk.password }}" validate_certs: false register: task_response until: task_response.status == 200 lookup('pipe', 'date +"%s"')|int - task_response.json.entry[0].content.startup_time > 10 retries: "{{ retry_num }}" delay: 30 ignore_errors: true no_log: "{{ hide_password }}" ... View more

same issue here ... any and all feedback would be greatly appreciated. ... View more

Has anybody figured this out. The official documentation I've read doesn't seem to address cases where TLS 1.2 is the only option for a splunk LDAP client to communicate with an openldap server. ... View more