topic Re: mvexpand gives "mvexpand output will be truncated due to excessive memory usage" in Monitoring Splunk

mvexpand gives "mvexpand output will be truncated due to excessive memory usage"

marcokrueger — Mon, 28 Sep 2020 14:32:55 GMT

I give my splunk 50GB Mem with
max_mem_usage_mb = 50480
in the limits.conf
but splunk 5.0.3 gives me a "mvexpand output will be truncated due to excessive memory usage".
THe job inspector shows that the incoming data are a few 10 MB.

Miss I a hidden config-option?

Best regards Marco

Re: mvexpand gives "mvexpand output will be truncated due to excessive memory usage"

fervin — Mon, 28 Sep 2020 14:37:54 GMT

Hi Marco,

I'm seeing the same behavior in 5.0.3. Did you ever find a solution? I'm trying to get some info from a REST input into a lookup, and the seemingly inefficient technique in the docs for spath to combine multivalued fields bombs at exactly 700 elements. Anybody else seeing this, or have any ideas?

-Frank

EDIT - Upgrading to 5.0.4 and greatly increasing max_mem_usage_mb did not resolve the problem for me but filtering out the _raw fields as Marco suggested did. My working query:

index=rest sourcetype=dns:rest:a | head 1 
| spath output=dns path={}.name 
| spath output=ip path={}.ipv4addr
| fields - _raw 
| eval record=mvzip(dns,ip)
| fields + record
| mvexpand record | eval record = split(record,",") 
| eval dns=mvindex(record,0) | eval ip=mvindex(record,1)   
| table dns,ip

Re: mvexpand gives "mvexpand output will be truncated due to excessive memory usage"

marcokrueger — Tue, 27 Aug 2013 05:39:15 GMT

Hi Frank,
in my case I have solved it. I suggest to remove alle fields you don't need anymore, before you call the mvexpand, like ... | fields dns, ip, record | fields - _raw | ...
Perhaps this helps.

By Marco

Re: mvexpand gives "mvexpand output will be truncated due to excessive memory usage"

marcokrueger — Mon, 28 Sep 2020 14:39:31 GMT

Hi Frank,
another solution may be to incease the max_mem_usage_mb in your limits.conf?

You can avoid the spath in your query, by defining it under
Manager » Fields » Field aliases

best regards
Marco

Re: mvexpand gives "mvexpand output will be truncated due to excessive memory usage"

fervin — Tue, 03 Sep 2013 18:18:04 GMT

Thanks, that fixed it.

Re: mvexpand gives "mvexpand output will be truncated due to excessive memory usage"

grittonc — Mon, 27 Nov 2017 15:34:43 GMT

Still a good answer in 2017.

Re: mvexpand gives "mvexpand output will be truncated due to excessive memory usage"

jstubberfield — Mon, 23 Jul 2018 03:59:37 GMT

This is still an excellent answer on 2018

Re: mvexpand gives "mvexpand output will be truncated due to excessive memory usage"

rafaelvjb — Thu, 11 Oct 2018 19:05:14 GMT

Tks man, "fields - _raw" fixed my problem

Re: mvexpand gives "mvexpand output will be truncated due to excessive memory usage"

balmeida — Tue, 05 Feb 2019 16:42:28 GMT

Still a good answer in 2019.

Re: mvexpand gives "mvexpand output will be truncated due to excessive memory usage"

sgundeti573 — Tue, 04 Jun 2019 14:03:17 GMT

June 2019 🙂

Re: mvexpand gives "mvexpand output will be truncated due to excessive memory usage"

LM_ACN — Wed, 23 Oct 2019 13:11:34 GMT

still Octuber 2019 🙂

Re: mvexpand gives "mvexpand output will be truncated due to excessive memory usage"

amckinnie_splun — Tue, 21 Jan 2020 22:18:49 GMT

still works in 2020

Re: mvexpand gives "mvexpand output will be truncated due to excessive memory usage"

gjanders — Wed, 22 Jan 2020 03:10:10 GMT

Another workaround is to use the "by" clause of a stats command to split a multivalued field into its values, it doesn't have the memory issue that mvexpand has...

Re: mvexpand gives "mvexpand output will be truncated due to excessive memory usage"

to4kawa — Wed, 22 Jan 2020 06:37:18 GMT

|makeresults count=10000
|streamstats count as t
|stats values(t) as multivalue 
|fields multivalue 
`comment("multivalue extract without mvexpand")`
|stats count by multivalue 
|table multivalue

All multi-values must be unique values, but that's OK

Re: mvexpand gives "mvexpand output will be truncated due to excessive memory usage"

ClubMed — Tue, 04 Jun 2024 00:27:32 GMT

Wow.

For all my queries, I had been using the following fields command under the assumption it did drop _raw.

| fields _time, xxx, yyy, zzz, ....

Then one day I started a large mvexpand and ran into memory limit.

My thought upon seeing this was 'Huh? Well, worth a try I guess.'

| fields _time, xxx, yyy, zzz, .... | fields - _raw

Boom, mvexpand completes successfully. The heck? It actually cut the search time in half too.

Re: mvexpand gives "mvexpand output will be truncated due to excessive memory usage"

dimarra — Tue, 03 Feb 2026 00:09:44 GMT

this one is the goat. 🐐

i have 5 events with 4 mv fields with around 4000 values each. so im expecting around 20k of rows.

mvexpand was giving the message, i started with truncated at 300...

i did the fields +/- was able to get it up to truncated at 1100. still not enough.

This Splunk Answers from 2020 did it.

cheers to you @to4kawa @gjanders 🍺