CODEWITHSUNDEEP
splunkfluent-bit
xxestter
xxestter

Reputation: 509

Character limit in Splunk

Just like to ask whether is there any character limit when fluentbit send logs to splunk? How can I increase the character limit via the Splunk Web UI?

Upvotes: 0

Views: 1830

Answers (2)

xxestter
xxestter

Reputation: 509

Create a new file called props.conf in "C:\Program Files\Splunk\etc\system\local"

For truncate setting in the props.conf local

[host::small_events]
TRUNCATE = 256

For more info:

https://docs.splunk.com/Documentation/Splunk/8.0.5/Admin/Propsconf

https://docs.splunk.com/Documentation/Splunk/9.0.2/Admin/Wheretofindtheconfigurationfiles#:~:text=Splunk%20software%20uses%20configuration%20files,the%20system%20as%20a%20whole.

Upvotes: 0

RichG
RichG

Reputation: 9926

It depends on how the data is sent to Splunk. If it comes in via HEC then the limit is 1 million bytes (not characters) and cannot be changed. If the data comes in via port 9997 then it does not have the same limit, but will be truncated at 10,000 bytes. The truncation can be set for the sourcetype via the TRUNCATE attribute in props.conf or at Settings->Source types.

Upvotes: 2

Related Questions