Splunk Search

Is there a limitation in the length of a search?

patricknguyen
Explorer

Hello,

I have a long Splunk search that I continue to add more conditions to each day so it keeps growing. Eventually, when my search starts to reach 25K long, it starts to fail. The browsers (both Firefox and Chrome) get disconnected from Splunk search head and fails every time I run the search. My question is whether any limitation in the search length that I can run on Splunk, and what is the limitation if any?

If there is no limitation, then I wonder if this is relating to browser itself, though I've been trying both Chrome and Firefox and they both fails with the same condition above.

Thanks,
-Patrick

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

YOu'll reach your browser limit before you'll reach Splunk's. Try to save your long search as saved search and try to use | savedsearch yoursavedsearchname to run it.

View solution in original post

DalJeanis
SplunkTrust
SplunkTrust

Okay, when your SEARCH gets to 25K long, it seems like you need to be looking for a new data model. Consider (meta)tagging your data with useful subsets of your search criteria.

0 Karma

gfreitas
Builder

I would suggest creating macros to make the search smaller. It`s very common to have huge searches but using macros to make them smaller. You can use for example a macro inside the other and make things easier for you.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

YOu'll reach your browser limit before you'll reach Splunk's. Try to save your long search as saved search and try to use | savedsearch yoursavedsearchname to run it.

patricknguyen
Explorer

Thank you all for your recommendations. I've been able to do "savedsearch <24K query> | search " to bypass browser limitation and get Splunk to process the search successfully per somesoni2 suggestion.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...