Splunk Search

Is it possible to have a search string so long that it can't be parsed in Splunk 6.0 or higher?

rroberts
Splunk Employee
Splunk Employee

Is this still a possibility with Splunk 6.0 and higher?

"The search process can't parse the search string. In the search.log"

INFO SearchParse -­ {1758 byte str!}
Meaning : This is a 1.7kb string…really long

1 Solution

martin_mueller
SplunkTrust
SplunkTrust

The longest search I've got sitting on my laptop's Splunk 6 is 6kB, through some generous copy&paste I've bumped it up to 20kB and it still runs without a hitch... so if there is a limit then 1.7kB or indeed 17kB isn't it.

Check for other events in search.log, especially more severe ones than INFO. If you find nothing you could post your search for us to take a look at what may be unparseable.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

The longest search I've got sitting on my laptop's Splunk 6 is 6kB, through some generous copy&paste I've bumped it up to 20kB and it still runs without a hitch... so if there is a limit then 1.7kB or indeed 17kB isn't it.

Check for other events in search.log, especially more severe ones than INFO. If you find nothing you could post your search for us to take a look at what may be unparseable.

martin_mueller
SplunkTrust
SplunkTrust

I'm curious, did you manage to find the culprit?

0 Karma

grijhwani
Motivator

1758 bytes is only 1.7kB. But good question!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...