While doing splunk API post call for KVStore one of the field [string] attribute size is large
so API call fails saying below statement
String value too long. valueSize=526402, maxValueSize=524288
Is there a way we can increase the field [string] length through configuration ?
Please let me know your suggestions
Actually as per Splunk Team. This issue is fixed in Splunk 8.2.6 or higher versions.
So we just need to upgrade to 8.2.6 atleast
Column size is increased from 512 KB. Need to confirm the next max possible Size
Thanks for the reply.
Let me check if we can limit the value below max size allowed for the attribute before inserting into KVStore
If you want to use that sized values on kvstore and also use is as lookup which you want to replicate to indexers you will have another issues....
Gentle Reminder...
Hi
I couldn’t any parameters on limits.conf or server.conf for that. Based on that probably this is not something what you could do by yourself? Maybe spunk support have something more?
Anyhow your value seems to be quite huge! Are you sure that you cannot do something for your data/process to avoiding store this size of thing to kvstore?
r. Ismo