I had previously posted this question earlier: http://answers.splunk.com/questions/9264/am-i-bumping-into-limits-issue-with-subsearch-results. I've done some deeper digging and I believe I'm having a general issue with transactions.
I've done a simple search over an index for a 15 minute window and come up with 75,000 events returned. When I run a simple search to build the transactions (index=smtp [search index=smtp | fields + messageid] | transaction messageid
) I end up receiving the same error:
Error in 'UnifiedSearch': Unable to parse the 'The specified search is too large. Please try to simplify your search.
What can be done to help resolve this issue?
Thanks!
It doesn't look like the subsearch is really needed here, since all it appears to be doing is making sure that the messageid field is populated.
How about just:
index=smtp messageid=* | transaction messageid
It doesn't look like the subsearch is really needed here, since all it appears to be doing is making sure that the messageid field is populated.
How about just:
index=smtp messageid=* | transaction messageid
Thanks much! Doing the search that way worked very nicely...