I'm trying to get a large text file ingested using the HEC. In my searches for the data, I see events that say "Message body length 3169085 greater than maximum allowed (2097152). Where can I change that maximum? I can't find any setting that says "Message body length", and I can't find any setting set to 2097152
Keep the truncate limit to 0 on the sourcetype, hopefully it should fix the problem.
Thanks for the info, I tried the solution in that article and it made to difference. My error message is different than the one in that article.