Fields are not extracting properly for the Eventhub Input in Splunk Add-on for Microsoft Cloud Services

Applicability

Description

This article information is about the issue with the fields extraction in some of the Event for the Eventhub input in Splunk Add-on for Microsoft Cloud services.

The fields are not extracting as expected in some of the events even the sourcetype is default mscs:azure:eventhub and input configuration has kv_mode = json.

Investigation

Upon further checking and investigation, it was found that in some of the events of Eventhub input exceeded the maximum character limit, due to which only those characters included, which are within the character limit; others are ignored.

Need to check the KV values from the below directory :

Path : 

$Splunk_home/etc/system/local/limits.conf

Default KV Stanza : 

[kv]
limit = 100
maxcols = 512
maxchars = 10240

Resolution

Increase the limit and maxchars in the limits.conf configuration file on the instance where the add-on is configured, Indexer, and Heavy Forwarder or IDM Instance (as per the Splunk Architecture) to the following parameters:

[kv]
limit = 1000
maxchars = 60000

Related Links

limits.conf