Ah, ok. Makes sense. So to confirm, if the indexer is truncating, does the truncated amount go towards the license or the amount sent from the forwarder? Thanks again! (Will accept your response to this question as I think it’ll be most applicable.) Som ... View more

I think that's the part I'm confused about then. Because I haven't made any changes to truncate events from the forwarder, but I'm still getting truncated events. According to several other results (here's one: https://community.splunk.com/t5/Knowledge-Management/What-is-the-maximum-length-of-a-tag-and-an-event/m-p/335077), this is default behavior and Splunk's default event size is 10K. But if you're saying that the forwarder doesn't truncate by default, then that is telling me that the entire log is sent to the indexer and then truncated on the indexer side. Which still leaves my question open -- is the full size being counted towards the license? Or the post-truncated 10K? Som ... View more

Ah, okay, thank you! To confirm -- the default 10K limit for event sizes is something that the basic install of the universal forwarder would apply. I ask because I'm assuming this means the universal forwarder installs with some kind of filter by default, as I don't believe I've set up any kind of filtering on it. Thanks again for your help! Som ... View more