Answer by warren for Does splunk server has any limit on data, when being sent through Curl request with groovy script?

Yes, there is a limit to how much the HTTP Event Collector (HEC) can accept in a single submission.

As of 9.0.3, it’s ~800MB:

max_content_length = <integer>
* The maximum length, in bytes, of HTTP request content that is
  accepted by the HTTP Event Collector server.
* Default: 838860800 (~ 800 MB)

from User warren – Stack Overflow https://stackoverflow.com/questions/75202723/does-splunk-server-has-any-limit-on-data-when-being-sent-through-curl-request-w/75210182#75210182
via IFTTT