About heath

krizi · ‎12-07-2020

A long time overdue, but just in case anyone stumbles upon this issue as well. Try to add LOOKAHEAD with larger number (e.g. 10000) to you your transformation stanza. You can find out more in transformations.conf documentation.

cpetterborg · ‎07-11-2017

somesoni2's comment above is 100% correct. If the data doesn't come in in order, then you can't easily (or even with only a little difficulty) do it at index time, it the data processes serially. Your options are search time or (seriously difficult) processing of the data before it goes to be indexed.

briancronrath · ‎01-10-2017

jsilverbears you might wanna check under the default instead of local directory, that's where I found mine in order to resolve the issue.

csharp_splunk · ‎06-17-2015

In 6.2 we added a cap for field size to limit the risk of unbounded memory growth. This field is MaxFieldSize, but unfortunately it didn't make it the docs. http://docs.splunk.com/Documentation/StreamApp/6.2.2/DeployStreamApp/ConfigureStreamForwarder#Configure_streamfwd.xml That docs page covers how to configure streamfwd.xml, and if you add a MaxFieldSize parameter you can up the limit to something larger if you're concerned about RAM growth or if not you can set the value to 0 for unlimited.

vshcherbakov_sp · ‎06-13-2015

Hello heath, AFAIK, it's not a known issue. Would you be able to provide a sample capture file that exhibits the problem so that we can take a look at it? Thanks in advance.

heath · ‎03-05-2015

Nice, thanks for the update. We'll try it out.

heath · ‎12-01-2014

Thanks. I had to update the line to include !ECDH. SSLProtocol All -SSLv2 SSLCipherSuite ALL:!ADH:!EDH:!EXP:!NULL:!ECDH

Posts	14
Solutions	1
Karma Given	5
Karma Received	1
Member Since	‎05-19-2011

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Is there a REGEX character limit on field replacem...

How can we create multiline events based on the va...

Why is dest_content in http stream data getting tr...

Are there known issues with stream and HTTP persis...

Is there something wrong with regex and dest_conte...

Does Splunk App for Stream support decrypting TLS ...

Re: Is there a REGEX character limit on field repl...

Re: How can we create multiline events based on th...

Re: Splunk DB Connect 2: Why am I getting error "C...

Re: Why is dest_content in http stream data gettin...

Re: Are there known issues with stream and HTTP pe...

Re: Is there something wrong with regex and dest_c...

Re: Does Splunk App for Stream support decrypting ...

Join the Conversation