Splunk ES integration processing stops because of logging large payloads - Known Error

Splunk ES integration processing stops because of logging large payloads Description Splunk ES integration fails to process the events from Splunk if a notable event with a large payload(25 MB +) is ingested. All the events would be stuck in the queued state, as logging the event exceeds the maximum permissible size.

Steps to Reproduce

Create or have a large payload in the sn_sec_splunkes_raw_data table Run the offending job called "Splunk ES Fetch SIDs" Alternatively run the below script to trigger the issue:

var gr = new GlideRecord('sn_sec_splunkes_raw_data'); gr.get( ); var a = sn_sec_cmn.JSONGlide; try {

a.stringify(gr); } catch (ex) { gs.error(ex); }

Workaround There is a fix available in version 12.0.12 or higher of the plugin. You may upgrade to the latest version to address this issue.

Alternatively, you may apply the attached update set, 'sys_remote_update_set_5f9a1bec379731108f7efdc734924bad.xml' which includes a minor fix in the script include: SplunkESRawData to resolve the issue.