Hi @SanjayReddy , I do see that props.conf have a few TRUNCATE setting. Do I change all of them so that longer message can be loaded in Splunk? or I change the default, splunkd, and KVstore will do? Just to update: I tried to add the following under the $Splunk_Home/etc/system/default/props.conf, the truncate didnt happen in version 9.0.5. [host::127.0.0.1:8088]
TRUNCATE = 256 My data came in via HEC.
... View more
I do see that props.conf have a few TRUNCATE setting. Do I change all of them so that longer message can be loaded in Splunk? or I change the default, splunkd, and KVstore will do?
... View more
Hi, thanks for the reply. I am using the latest version(9.0.1) and the older version(8.0.5), and 9.0.1 able to send more than 10k of data without changing the configuration. Whereas 8.0.5 truncate around 10k.
... View more
Hi, May I check whether is there character limits when sending data to Splunk? Is there 10000 limit on Splunk Enterprise version 8.0.5? Thanks!
... View more
Hi there, appreciate if anyone could help me with these query.
I am trying to pump local file to splunk using fluentbit. The Splunk is currently https and secure.
I kept encountering error message of unexpected EOF, I am not sure what have I done wrongly in the fluent-bit.config file.
This is the screenshot of the splunk's general settting
Below is the fluent-bit.config that I used with the fluent-bit.exe..
[INPUT] Name tail Tag taglog Path C:\*.json [OUTPUT] Name splunk Match * Host localhost Port 443 Splunk_Token <The HTTP Event Collector token generated in Splunk Web> TLS On TLS.Verify On http_user <The username login to Splunk Web> http_passwd <The password used to login to Splunk Web> splunk_send_raw On
when i set the "TLS.Verify" to Off, it will have 303 http status code
... View more