The default values and how to change the maximum size of one event (maximum size of one line, maximum number of lines) are described below.

About the maximum size of one line

The maximum size of one line is 10000 bytes by default.

Data exceeding 10000 bytes per line will be truncated after 10001 bytes.

To change it, change the TRUNCATE value in the props.conf file.

Setting Example

<Target files>

Heavy forwarder, indexer (if not using heavy forwarder)

$SPLUNK_HOME/etc/apps/<App名>/local/props.conf

or

$SPLUNK_HOME/etc/system/local/props.conf

<Setting details>

[test]
TRUNCATE=50000

*Specify the maximum size of one line in bytes.

*Setting TRUNCATE=0 will prevent truncation.
Please note the following and specify the required size according to your environment.
Note
When importing data with a large number of characters per line, this may affect performance.

*$SPLUNK_HOME is the installation directory. By default it is as follows.

Splunk Enterprise : /opt/splunk
Universal Forwarder : /opt/splunkforwarder

Splunk Enterprise : C:\Program Files\Splunk
Universal Forwarder : C:\Program Files\SplunkUniversalForwarder

After making any configuration changes, restart the Splunk service.

$SPLUNK_HOME/bin/splunk restart

About the maximum number of lines for one event

The default maximum number of lines per event is 257.
From then on, events will be split and imported.

To change it, change the MAX_EVENTS value in the props.conf file.

<Setting example>

To capture an event with source type "test" and change its maximum row count:

<Target files>

Heavy forwarder, indexer (if not using heavy forwarder)

$SPLUNK_HOME/etc/apps/<App名>/local/props.conf

or

$SPLUNK_HOME/etc/system/local/props.conf

<Setting details>

[test]
MAX_EVENTS=256

*Specify the number of lines. There is no upper limit.

*After changing the settings, please restart the Splunk service.

$SPLUNK_HOME/bin/splunk restart

Notes

Both TRUNCATE and MAX_EVENTS are limitations to avoid impacting indexing and search performance.

When changing it, specify the size you need, not a value that is effectively unlimited.