topic Re: mvexpand in Splunk Enterprise

Receiving error while using mvexpand

super_saiyan — Mon, 15 Aug 2022 13:51:08 GMT

While using the mvexpand command, i am getting the below error.

ERROR -

command.mvexpand: output will be truncated at 1000 results due to excessive memory usage. Memory threshold of 500 MB as configured in limits.conf /[mvexpand]/max_mem_usage_mb has been reached.

Question 1- How can i resolve the above error ?

Question 2 - Is there any other alternative command of mvexpand ?

Re: mvexpand

ITWhisperer — Mon, 15 Aug 2022 08:08:09 GMT

mvexpand functionality can be replicated to some extent using makecontinuous

https://community.splunk.com/t5/Splunk-Enterprise/Mutlivalue-Field-Problem-Is-there-any-way-to-do-this-without/m-p/608898/highlight/true?search-action-id=87185142412&search-result-uid=608898#M13589

However, you may still run into memory issues.

The memory issue can be postponed by configuring more memory in limits.conf

Re: mvexpand

VatsalJagani — Mon, 15 Aug 2022 11:15:58 GMT

@super_saiyan - Generally you should look at the option of changing your query in such a way that you do not require to use mvexpand. (Avoid multi-valued fields where you expect to have more than 1000 values.)

If not possible, then you can look at the option provided by @ITWhisperer

I hope this helps!!!

Re: mvexpand

PickleRick — Mon, 15 Aug 2022 11:26:33 GMT

You can raise the limits of course to delay the onset of the problem a little, as others already mention. But the question is why do you have such a big mvexpand. If you're mvexpanding original events, maybe it's worth reviewing onboarding of this sourcetype. If it's because you did some huge "stats values" or something similar, maybe you should review your search and try to get to the results another way.