https://community.splunk.com/t5/Monitoring-Splunk/Memory-tuning-guide/m-p/458062#M3861 <P>All,</P> <P>I am receiving this error message in a relatgively small Splunk stack that is brand new.</P> <PRE><CODE>3 errors occurred while the search was executing. Therefore, search results might be incomplete. Hide errors. [someserver.domain.com] Events might not be returned in sub-second order due to search memory limits. See search.log for more information. Increase the value of the following limits.conf setting:[search]:max_rawsize_perchunk. </CODE></PRE> <P>Is there a tuning guide for this? Any alerts or dashboards I should be looking at?</P> Sat, 06 Jun 2020 01:23:16 GMT daniel333 2020-06-06T01:23:16Z https://community.splunk.com/t5/Monitoring-Splunk/Memory-tuning-guide/m-p/458062#M3861 <P>All,</P> <P>I am receiving this error message in a relatgively small Splunk stack that is brand new.</P> <PRE><CODE>3 errors occurred while the search was executing. Therefore, search results might be incomplete. Hide errors. [someserver.domain.com] Events might not be returned in sub-second order due to search memory limits. See search.log for more information. Increase the value of the following limits.conf setting:[search]:max_rawsize_perchunk. </CODE></PRE> <P>Is there a tuning guide for this? Any alerts or dashboards I should be looking at?</P> Sat, 06 Jun 2020 01:23:16 GMT https://community.splunk.com/t5/Monitoring-Splunk/Memory-tuning-guide/m-p/458062#M3861 daniel333 2020-06-06T01:23:16Z https://community.splunk.com/t5/Monitoring-Splunk/Memory-tuning-guide/m-p/458063#M3862 <P>Take a look at this <A href="https://answers.splunk.com/answers/121257/events-may-not-be-returned-in-sub-second-order-due-to-search-memory-limits-configured-in-limits-conf-search-max-rawsize-perchunk-error-after-upgrade-to-splunk-6-0-1.html">https://answers.splunk.com/answers/121257/events-may-not-be-returned-in-sub-second-order-due-to-search-memory-limits-configured-in-limits-conf-search-max-rawsize-perchunk-error-after-upgrade-to-splunk-6-0-1.html</A></P> Wed, 21 Aug 2019 16:42:22 GMT https://community.splunk.com/t5/Monitoring-Splunk/Memory-tuning-guide/m-p/458063#M3862 jessec_splunk 2019-08-21T16:42:22Z https://community.splunk.com/t5/Monitoring-Splunk/Memory-tuning-guide/m-p/458064#M3863 <P>Bumped to 1gig from 100megs and problem went away. DMC says system resources are solid still. Any downside to increasing that number?</P> Wed, 21 Aug 2019 21:30:10 GMT https://community.splunk.com/t5/Monitoring-Splunk/Memory-tuning-guide/m-p/458064#M3863 daniel333 2019-08-21T21:30:10Z