Splunk Search

Is it possible to have a search string so long that it can't be parsed in Splunk 6.0 or higher?

rroberts
Splunk Employee
Splunk Employee

Is this still a possibility with Splunk 6.0 and higher?

"The search process can't parse the search string. In the search.log"

INFO SearchParse -­ {1758 byte str!}
Meaning : This is a 1.7kb string…really long

1 Solution

martin_mueller
SplunkTrust
SplunkTrust

The longest search I've got sitting on my laptop's Splunk 6 is 6kB, through some generous copy&paste I've bumped it up to 20kB and it still runs without a hitch... so if there is a limit then 1.7kB or indeed 17kB isn't it.

Check for other events in search.log, especially more severe ones than INFO. If you find nothing you could post your search for us to take a look at what may be unparseable.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

The longest search I've got sitting on my laptop's Splunk 6 is 6kB, through some generous copy&paste I've bumped it up to 20kB and it still runs without a hitch... so if there is a limit then 1.7kB or indeed 17kB isn't it.

Check for other events in search.log, especially more severe ones than INFO. If you find nothing you could post your search for us to take a look at what may be unparseable.

martin_mueller
SplunkTrust
SplunkTrust

I'm curious, did you manage to find the culprit?

0 Karma

grijhwani
Motivator

1758 bytes is only 1.7kB. But good question!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...