Splunk Configuration

Splunk's default configuration can cause data loss or indexing issues when using saf convert:hdf2splunk. Please enact the following changes to your Splunk server's configuration files (typically in /opt/splunk/etc/system/local/) before using the command.

limits.conf docs

[kv]
limit = 10000000
maxchars = 1000000

props.conf docs

[HDF2Splunk]
SHOULD_LINEMERGE = false
EVENT_BREAKER_ENABLE = true
EVENT_BREAKER = ([\n]+)
TRUNCATE = 0