I get strange errors when searching messages by old dates.
If I put a search for more than two hours, I immediately get the following errors:
From four days:
One of my requests:
index="external_system" messageType="RABIS-HeartBeat"
| eval timeValue='eventTime'
| eval time=strptime(timeValue,"%Y-%m-%dT%H:%M:%S")
| sort -_time
| eval timeValue='eventTime'
| eval time=strptime(timeValue,"%Y-%m-%dT%H:%M:%S")
| eval Time=strftime(_time,"%Y-%m-%dT%H:%M:%S")
| stats list(Time) as Time list(eventTime) as EventTime list(messageType) as MessageType list(messageId) as Messag11eId by messageType
Message example:
curl --location --request POST 'http://mon.pd.dev.sis.org:8088/services/collector/raw' --header 'Authorization: Splunk 02-93-48-9-27' --header 'Content-Type: text/plain' --data-raw '{
"messageType": "HeartBeat",
"eventTime": "2022-11-14T13:34:15",
"messageId": "ED280816-E404-444A-A2D9-FFD2D171F9999"
}'
Can you please tell me how to solve these problems?
From limits.conf:
[stats]
...
list_maxsize = 100
...
Just note that list is very expensive in terms of RAM. If you have a lot of events, list(Time) as Time list(eventTime) as EventTime is practically suicidal. It is best to avoid such stats.
All. I'm sorry, I saw that these are the settings: limits.conf
From limits.conf:
[stats]
...
list_maxsize = 100
...
Just note that list is very expensive in terms of RAM. If you have a lot of events, list(Time) as Time list(eventTime) as EventTime is practically suicidal. It is best to avoid such stats.
I try like this for example:
| eval src_Msg_Id=if(len('srcMsgId')==0 OR isnull('srcMsgId')," ",'srcMsgId')
| stats list_maxsize = 10000
| stats list(diff) as TIME_DIF list(event_Time) as EventTime list(src_Msg_Id) as srcMsgId_Бизнес_Сообщения list(routepoint_ID) as RoutepointID list(t_i_d) as Tid list(GISGMP_Request) as GISGMPRequestID list(message_Type) as MessageType list(Packet_GIS_GMP_Id) as PacketGISGMPId count as Кол_Сообщений by srcMsgId_Исх_Сообщения
But it doesn't help
Hello, tell me, where should I add this in the request?
Request example:
index="main"
| eval srcMsgId_Исх_Сообщения=if(len('Correlation_srcMsgId')==0 OR isnull('Correlation_srcMsgId'),'srcMsgId','Correlation_srcMsgId')
| eval timeValue='eventTime'
| eval time=strptime(timeValue,"%Y-%m-%dT%H:%M:%S.%3N%Z") | sort -eventTime | streamstats values(time) current=f window=1 as STERAM_RESULT global=false by srcMsgId_Исх_Сообщения
| eval diff=STERAM_RESULT-time
| stats list(diff) as TIME_DIF list(eventTime) as eventTime list(srcMsgId) as srcMsgId_Бизнес_Сообщения list(routepointID) as routepointID count as Кол_Сообщений by srcMsgId_Исх_Сообщения